b738cf6cc02c72b9ed932f60f61ffab23b806275837058328153f8d271b8c527

Analysis

max time kernel
301s
max time network
229s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LogonUIInstaller.exe
Size 49.1MB
Sample260907-r421tsxtcs
SHA256 b738cf6cc02c72b9ed932f60f61ffab23b806275837058328153f8d271b8c527
MD5 c0fbb236d2a15b4490483efcce56e40a
SHA1 38965c344228c59f05ee7013996882f36b564cb6
SHA512 fac917e8a64ae405b944a0926e6e4efb79040e95e911dd637eb2efaa2fc2b2b76b6d1aae1f81c00d8aacce7323e7b05ea51730d507195d60646583ba7e4d3a5d
SSDEEP 786432:wU1okWpN3kk9blZYMUKM/p8IgTO/HV968PbXtWri4BnKaFtKU:wxkWLPZxUHgTCKUvS9K
TLSH
T1B7B7338B416E3186CC2789301CBB12A5F9B71C2D7506ABA6E291FF307677D14FA50E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5332	takeown.exe
2628	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5332	takeown.exe
2628	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	LogonUIInstaller.exe
File opened (read-only)	\??\D:	LogonUIInstaller.exe
File opened (read-only)	\??\G:	LogonUIInstaller.exe
File opened (read-only)	\??\K:	LogonUIInstaller.exe
File opened (read-only)	\??\M:	LogonUIInstaller.exe
File opened (read-only)	\??\V:	LogonUIInstaller.exe
File opened (read-only)	\??\W:	LogonUIInstaller.exe
File opened (read-only)	\??\Y:	LogonUIInstaller.exe
File opened (read-only)	\??\H:	LogonUIInstaller.exe
File opened (read-only)	\??\O:	LogonUIInstaller.exe
File opened (read-only)	\??\T:	LogonUIInstaller.exe
File opened (read-only)	\??\A:	LogonUIInstaller.exe
File opened (read-only)	\??\J:	LogonUIInstaller.exe
File opened (read-only)	\??\L:	LogonUIInstaller.exe
File opened (read-only)	\??\P:	LogonUIInstaller.exe
File opened (read-only)	\??\Q:	LogonUIInstaller.exe
File opened (read-only)	\??\R:	LogonUIInstaller.exe
File opened (read-only)	\??\U:	LogonUIInstaller.exe
File opened (read-only)	\??\X:	LogonUIInstaller.exe
File opened (read-only)	\??\I:	LogonUIInstaller.exe
File opened (read-only)	\??\N:	LogonUIInstaller.exe
File opened (read-only)	\??\S:	LogonUIInstaller.exe
File opened (read-only)	\??\Z:	LogonUIInstaller.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\LogonUI.exe	LogonUIInstaller.exe
File opened for modification	C:\Windows\System32\LogonUI.exe	LogonUIInstaller.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3280	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4896	LogonUIInstaller.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5332	takeown.exe
Token: SeDebugPrivilege	4896	LogonUIInstaller.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeShutdownPrivilege	4896	LogonUIInstaller.exe
Token: SeCreatePagefilePrivilege	4896	LogonUIInstaller.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5332	4896	LogonUIInstaller.exe	89
PID 4896 wrote to memory of 2628	4896	LogonUIInstaller.exe	91
PID 4896 wrote to memory of 3280	4896	LogonUIInstaller.exe	93

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	LogonUIInstaller.exe

C:\Users\Admin\AppData\Local\Temp\LogonUIInstaller.exe
C:\Users\Admin\AppData\Local\Temp\LogonUIInstaller.exe stage2
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4896
- C:\Windows\SYSTEM32\takeown.exe
  "takeown.exe" /f "C:\Windows\System32\LogonUI.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" "C:\Windows\System32\LogonUI.exe" /grant Everyone:F /grant SYSTEM:F /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2628
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /f /im LogonUI.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.gif

Path C:\Users\Admin\AppData\Roaming\SystemUpdate\hr.gif
Size 1.4MB
SHA256 6affb38603ae9a596fded76b5fb7c7d177976168a2c5395a1a45e7ae25bcc29a
MD5 f4eb416e6f3c8c6c2f761231ef0941ea
SHA1 b554c01283b8e465fc0d83e4393470069c18c905
SHA512 89f3695592f5774480a68eebdafb70476d159774fd05622e3485b4958a8fc88cd4a0d6e4534391226f74a262049546250224832a144bd3192e4dd5a03db635b2
SSDEEP 24576:wB3Nf0ZqrGrwkZayTQFR2VedUerx7kkvKxY41KbvqC5FZQH:M9w/FxQfzUer9imxvnRQH
TLSH
T152653359C196D742CE9FC2AE03DB2348EF9C5C0233714069DA9E62E6708A7E9F0B1D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kf.gif

Path C:\Users\Admin\AppData\Roaming\SystemUpdate\kf.gif
Size 13.4MB
SHA256 90a1f45ed8217771141a946c1b83234746bba5fc6e2760aa917d7f7838e60135
MD5 eb1d5ffa9e7b94bb460deb82f1eabe24
SHA1 1435daeb2ba478377e71928467a9def27d4b38fb
SHA512 6f20fa4f2c9ceb14c79ea97f977142b064c02746df57aeb9d0384f95bd5d0b301b9487a82d7949bc95eb95ac552fd4e02c6a123101adf7d9e042a92e3f6c0f63
SSDEEP 196608:H68Xge66Xflu7VC8S4yiVB/j6Q1jlOo0MRDnztC9r5E/s4S4L4J/9LqfSa:H6KBo7p5V968P1RDztWrG77EJza
TLSH
T156E633CF152B11532A20C93424549ADEB7A63C3AE10FAE292A57DC22E7CFC5D7444FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kj.gif

Path C:\Users\Admin\AppData\Roaming\SystemUpdate\kj.gif
Size 1.3MB
SHA256 d833f610cd7eb9755618520c2e43d6ab5bf64e7bf1918b76b9b8be1c8b649127
MD5 cfb6a5f54223e554f73a2c3a66f25daf
SHA1 ed75e6588474c040dbe7b850f9f7ba7b149436cc
SHA512 5d04c73001d013cac1187eed64e87db18301be6caa4d07433428f7ac77a3cf89722cd2d8147146adbc82bb055f9da2894e60ea4c0d5972fddfa9481e34ba28a2
SSDEEP 24576:TFH/3R3mWVfxO2Jl5VEPjRcC5OErp3XYvQh71xehjlqVecuayP:x/B2WV02JlS5rBa2ShjlsevP
TLSH
T14E551259D17C4CC19E1E203432152B714DA744BD89F6FA377388FF8A978382EBAD0696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vd.gif

Path C:\Users\Admin\AppData\Roaming\SystemUpdate\vd.gif
Size 16.1MB
SHA256 b6c4f98f2480bc95ad35a3bfc9d902a6086477c803ffd8b1ffc888ab96392a82
MD5 d246a402100e3c83ca0c141e66750a50
SHA1 eb4af0864ee33e5ea94add003f661b5099b6649d
SHA512 7d9fe81ce2e43d2746c07643169f4da794181fa77400d937262310a8ec8f1bb83b6b96ed29fa49575ba678ce61ab55c908b9e650ad913fa637c8f4aefd640f48
SSDEEP 393216:UWpNdZ96Gc6tAQxNIaG+ZuCZlQLYJU/yh/u/0c38ItmGs:UWpN3kk9blZYMUKM/p8IgH
TLSH
T142073303095C01E43C328CA295BF779778E675B9B5DF88E5A7D46A01AC60407EBA4ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4896-3-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-6-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-28-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-30-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-31-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-32-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/4896-0-0x00007FFD0D2DF000-0x00007FFD0D2E0000-memory.dmp

Download

memory/4896-2-0x000001321E9D0000-0x0000013221AF6000-memory.dmp

Download

memory/4896-1-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download