50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee

Analysis

max time kernel
4s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:56

Reason

Machine shutdown

Target
50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe
Size 2.6MB
Sample260910-3zaasshr9t
SHA256 50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee
MD5 fbbc3cf3f1073fadf9285e183424efd6
SHA1 e6d24514def8e82701a4a0dab11969302bdb28a4
SHA512 b71ad7e3d8351c0a58618b57ab1ad8584a8ea98bf6921dea8058a982459357126d6de11678ea14fdd8794954d01af15c646a92a5738421e4c4b7bec27b7e2ba1
SSDEEP 49152:qEd8xb6plSxsKqIzInXRrJZEkzu5ioIw:qHwrJZEkSUo
TLSH
T173D57C47BCD118AAC0AAA3358AA652827B75BC490F3263D73E50B33C2FB3BD45975744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1240	shutdown.exe
Token: SeRemoteShutdownPrivilege	1240	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5460	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1240	4932	50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe	90

C:\Users\Admin\AppData\Local\Temp\50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe
"C:\Users\Admin\AppData\Local\Temp\50230a030a3be34835e70c8c076d3949a294ac3a0ef584d1c6988b009e0aedee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\shutdown.exe
  shutdown /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4704