Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 14:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xlr8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
xlr8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target xlr8.exe
- Size 1.1MB
- Sample260930-r7ckcaad78
- SHA256 13f4396bd5b236b0f5c7bf3cb9d386ec842ab73017b930cc312995326c03b170
- MD5 871704e2078b89c80eef74ca86122125
- SHA1 ae273304e3e8419bd1334aa0ae1b065b2cf9858f
- SHA512 efeebed5985c064432b5e2a142cf59993ebad6a58dcda11b6a0a8c696d1f2714eb32c3b23abc94d02dc3cc99401cb9df8f0cc28450f158b3a618fe7e5415e55a
- SSDEEP 24576:DOvKl3msFIL58H3Tl8kZ1eDfrEOgUHoEisIeCBC4em0o:1msFIL5QR8wirERkisjPw
- TLSH T17E45BF55B3A412B5E3B6D534CD824412FA72BC494F3099DB43B299662F236E38F3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl LogonUI.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\705687830\2496835819.pri LogonUI.exe File created C:\Windows\rescache\_merged\1190018277\3240961962.pri LogonUI.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 LogonUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz LogonUI.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings ctfmon.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Colors LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409" LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions\Pinned\ LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting ctfmon.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Quick Actions\Pinned LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000 LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP LogonUI.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7 LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}" LogonUI.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4256 LogonUI.exe Token: SeCreatePagefilePrivilege 4256 LogonUI.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4256 LogonUI.exe 4256 LogonUI.exe 4256 LogonUI.exe 4256 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xlr8.exe"C:\Users\Admin\AppData\Local\Temp\xlr8.exe"1⤵PID:5480
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a22855 /state1:0x41c64e6d1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4256
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2572
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000244;0000000000000288;1⤵
- Modifies data under HKEY_USERS
PID:4980