674d2c0e69ccdc744e80860402ac943b4e52af4702cfb1b26eba9d6fd08f2818

Analysis

user interaction
yes
max time kernel
108s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 11:15

Reason

Machine shutdown

Target
260911-mdxafavshs_pw_infected.zip
Size 4KB
Sample260913-ncsfjafq2t
SHA256 674d2c0e69ccdc744e80860402ac943b4e52af4702cfb1b26eba9d6fd08f2818
MD5 11db887cceb6ca975672d4f875200310
SHA1 5da0bd8764bbddfdcc755b5ff5bbcd144ce2072b
SHA512 5e680a18bf94c7afc327cdade658db13f871641a3f9c598c057db3e41e27faf473e1a910658f7bc41c306acc89d050894dae3b105bba375d37a4ab464351a1a2
SSDEEP 96:eKEH8hWce1zjp1mpIXRlsgTy/g596x6qTBoT1HhIiPj9JUhuDW8JI:bEH8FeY6vsgT0pxFmTfbB4SjJI
TLSH
T189A19EA879A07233D2595EB2C9AA26BE021B7338F564F02B02CC5B2CB51E00C39E54F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	LogonUI.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\260911-mdxafavshs_pw_infected.zip
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:6076