8eb2d8d5e0d0f29667a5563f69a64402198327debe38c682f2b6621af9fa2fb4

Analysis

user interaction
yes
max time kernel
13s
max time network
14s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/10/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
feet pics.exe
Size 138KB
Sample261022-tasleafy7l
SHA256 8eb2d8d5e0d0f29667a5563f69a64402198327debe38c682f2b6621af9fa2fb4
MD5 cd3bad395496614be1265ed868b1353a
SHA1 f9dd746dcbb2b77dad0d712c5bcab893f4332f66
SHA512 d7597bc4082a0bbb30dc9a7d41b0541bc60e8916c5ae8096506c40463579b45b103b84b19d80de006c5f84e1d1169aa091dfa80cee148b24c9f32732f0a98e18
SSDEEP 1536:u9VS86uBSn5GumuVyQNaC4sQhe2rHDkgAX9rP+cUULBBB8:u9VS86nRmuVynCQjkgAX9rP+cUULBBB
TLSH
T109D3FAA65E2637EFC0AD037AF28F9D240FB179419AA2F61C1591F01BDE51CDD8AC7062
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2732	shutdown.exe
Token: SeRemoteShutdownPrivilege	2732	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3672	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5188 wrote to memory of 2732	5188	feet pics.exe	82

C:\Users\Admin\AppData\Local\Temp\feet pics.exe
"C:\Users\Admin\AppData\Local\Temp\feet pics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\SYSTEM32\shutdown.exe
  "shutdown" /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2f055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5188-0-0x0000000000A50000-0x0000000000A78000-memory.dmp

Download