ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d

Analysis

max time kernel
9s
max time network
12s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:03

Reason

Machine shutdown

Target
2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe
Size 383KB
Sample261102-gr4nsafs3x
SHA256 ea5075cf54bbcf7da9496161996cd7dafdf7cb0d5abecc48540246f717895b8d
MD5 e01dcb8f26ca34dc3fd059e052931968
SHA1 15175456632d56d68c13f427e4e251c0f3e7d5ce
SHA512 fe052a10c70a34bf0bdbf166c36fdbe50d337fe73f3e351736ed56622092a4b7ad6e29ab13168bfe331a7a546febffc8715e32df574907240e587c2ceddec42f
SSDEEP 6144:rdL6RkzYBf70/hpLIG1C6cUmQvZB4v8INYch9HRg6gYZEQV5vrhU09NxChMBQ6:B6HTgpHsQmDNXrH1ZNd7K
TLSH
T15C844A15FA5618ECE056C13482568972A97278CE0B31ADFF22D842383F7ABF55E3CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	5096	reg.exe
Token: SeRestorePrivilege	3864	reg.exe
Token: SeRestorePrivilege	3648	reg.exe
Token: SeShutdownPrivilege	6104	shutdown.exe
Token: SeRemoteShutdownPrivilege	6104	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1420	LogonUI.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5096	3316	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	90
PID 3316 wrote to memory of 3864	3316	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	91
PID 3316 wrote to memory of 3648	3316	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	92
PID 3316 wrote to memory of 4820	3316	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	93
PID 3316 wrote to memory of 6104	3316	2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e01dcb8f26ca34dc3fd059e052931968_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\reg.exe
  "reg.exe" unload HKLM\HSX_OFF_SYS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\reg.exe
  "reg.exe" unload HKLM\HSX_OFF_SOFT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\system32\reg.exe
  "reg.exe" load HKLM\HSX_OFF_SYS C:\Windows\System32\config\SYSTEM
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\System32\sfc.exe
  "C:\Windows\System32\sfc.exe" /scannow /offbootdir=C:\ /offwindir=C:\Windows
  2⤵
  PID:4820
- C:\Windows\system32\shutdown.exe
  "shutdown.exe" /r /t 0 /f
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4624