50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee

Analysis

max time kernel
3s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe
Size 2.6MB
Sample260910-3zaasshr9t
SHA256 50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee
MD5 fbbc3cf3f1073fadf9285e183424efd6
SHA1 e6d24514def8e82701a4a0dab11969302bdb28a4
SHA512 b71ad7e3d8351c0a58618b57ab1ad8584a8ea98bf6921dea8058a982459357126d6de11678ea14fdd8794954d01af15c646a92a5738421e4c4b7bec27b7e2ba1
SSDEEP 49152:qEd8xb6plSxsKqIzInXRrJZEkzu5ioIw:qHwrJZEkSUo
TLSH
T173D57C47BCD118AAC0AAA3358AA652827B75BC490F3263D73E50B33C2FB3BD45975744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "25"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	shutdown.exe
Token: SeRemoteShutdownPrivilege	3080	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3080	2340	50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe	84

C:\Users\Admin\AppData\Local\Temp\50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe
"C:\Users\Admin\AppData\Local\Temp\50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3953055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4116

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads