2cc2e264653d7e6b55908c7116d0328715925e402f036981b2bad8194ab457e0

Analysis

user interaction
yes
max time kernel
45s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WandEnhancer-UpdateNotifications.exe
Size 2.0MB
Sample261017-kaevwaws7m
SHA256 2cc2e264653d7e6b55908c7116d0328715925e402f036981b2bad8194ab457e0
MD5 a6c262fea260dea35be4d9d307ef8ed5
SHA1 64bc049936a9ffde1ae445236fe2a8b9e7b242e8
SHA512 0cf4d180bc3132da26d76df3a7f86056bc3949b67a778215bb6b3d678b8e07b64361b4986584e6353b7a8130358e053d4d9147ab97a4ce2d3309e54d40d98104
SSDEEP 24576:eRpWvIYAhdfamXIfgj1jLtYgmoloBbPpFV8BsL3QSeLs1h8:e3dfGgj1jLtYgmioBH2BsL3Q
TLSH
T10C9539107BA8DF26E9AF0636A071443553B3EC1A5B9B971BE608FE7D1D723007E513A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WandEnhancer-UpdateNotifications.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WandEnhancer-UpdateNotifications.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	WandEnhancer-UpdateNotifications.exe
3784	WandEnhancer-UpdateNotifications.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	WandEnhancer-UpdateNotifications.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3784	WandEnhancer-UpdateNotifications.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2192	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\WandEnhancer-UpdateNotifications.exe
"C:\Users\Admin\AppData\Local\Temp\WandEnhancer-UpdateNotifications.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3784

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3996055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-0-0x0000000000810000-0x0000000000A0A000-memory.dmp

Download

memory/3784-1-0x0000000001400000-0x000000000141A000-memory.dmp

Download

memory/3784-2-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download

memory/3784-4-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download

memory/3784-3-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download

memory/3784-5-0x0000000024820000-0x0000000024828000-memory.dmp

Download

memory/3784-6-0x00000000250B0000-0x00000000250E8000-memory.dmp

Download

memory/3784-7-0x0000000025070000-0x000000002507E000-memory.dmp

Download

memory/3784-8-0x0000000026C20000-0x0000000026C42000-memory.dmp

Download

memory/3784-9-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download

memory/3784-10-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download

memory/3784-11-0x000000001DD10000-0x000000001DD20000-memory.dmp

Download