Analysis
-
max time kernel
302s -
max time network
277s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-08-2021 08:34
Static task
static1
Behavioral task
behavioral1
Sample
lcok.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
lcok.exe
-
Size
393KB
-
MD5
a96fd151b0afb913af10354e6f6ca1be
-
SHA1
709182b6336e1215e438c6456d50edb3b11c1fb3
-
SHA256
2b9fc5425a407d707354298c59ceb30f601707ed5878687049bf15e088ce4c24
-
SHA512
86e9fb857dc825afc3daf19bab482be337c507875d937596e5407a01ca903b1542793877b07e10d69a9b365438a34568945f2b15ccb3064a13a0356e6a7e73ac
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 4144 1628 4264 4268 4252 4240 4248 4232 4220 4280 3332 4332 4384 2828 4376 4400 2852 4388 4392 2704 3820 2668 516 428 500 592 1008 192 208 3828 2620 648 652 4284 820 4300 4140 4304 3152 1884 3564 812 864 908 424 692 844 1044 1064 1124 1204 1232 1224 1288 1384 1428 1468 1536 1532 1584 1588 1712 1828 1836 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
LogonUI.exepid process 1832 LogonUI.exe 1832 LogonUI.exe