abe8834f215a55c6e37cb0504d2d431fd095c7a464d7b5618f185e1624b5758e

Resubmissions

10/09/2026, 14:58

260910-sb8tcaveph

10/09/2026, 14:06

260910-rew4aaysdv7

Analysis

user interaction
yes
max time kernel
251s
max time network
276s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Scritchy Scratchy/ScritchyScratchy_Data/Resources/unity_builtin_extra
Size 357KB
Sample260910-rew4aaysdv
SHA256 abe8834f215a55c6e37cb0504d2d431fd095c7a464d7b5618f185e1624b5758e
MD5 c87bbe155df23f3e78aa73afe732face
SHA1 523707987455f7707a380af56714e1f346824d55
SHA512 d30ca08a2c0e3390a2c123fffbd2a8d8410ca3a8cb826dfac127a9dd20ef3acd76c60a7e20323e6ed4b6ad215b73982ed45fe53d2628b965f46ff7ca651eb05c
SSDEEP 3072:MoipwxxN9ZvwQGV/afS4gLflU6e8PLi7rL2r:Moi6xxdw7afgLbjPO7mr
TLSH
T13E74F979635B583FCC21153748BA0B739731A5F81BEE0F236E2C6F6C28E5288AB11754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1380	LogonUI.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Scritchy Scratchy\ScritchyScratchy_Data\Resources\unity_builtin_extra"
1⤵
- Executes a command shell one-liner
PID:2528

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a25855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads