db61a932fbc7fd9e9a27db350e79d2d03a72fb867215c99b23178573716831f2

Resubmissions

17/07/2026, 10:45

260717-mtl5eahs7n10

17/07/2026, 10:43

260717-mscjkscz4v10

Analysis

user interaction
yes
max time kernel
52s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
lcb_crack.exe
Size 4.7MB
Sample260717-mtl5eahs7n
SHA256 db61a932fbc7fd9e9a27db350e79d2d03a72fb867215c99b23178573716831f2
MD5 1b6b7455136c0963bb14709d34189723
SHA1 e5494c08ea4b095ead23f42c4acb8e83bcedde1d
SHA512 f1bf5d74239a6b4725e06c2784ec9723cf13d349a94b8e0cf0463b202709682ed41a5f982f74a392d47b15de9ee5de442de383c844baea1702ced39561ba5673
SSDEEP 98304:+KApEAd7uSiZCsBYp1gxwLpZu4HM/M763H/m2ypD:+B1d7uVCsE1gwpZ/HM/BmbpD
TLSH
T14A36230ED7E421BDE167D278CE434911D672BC4A8761DACF13A47AA20F732A0DE39752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
1984	lcb_spoof_crack.exe
5920	lcb_spoof_crack1.exe
3284	lcb_spoof_crack.exe
6024	icsys.icn.exe
3204	explorer.exe
1172	spoolsv.exe
1980	svchost.exe
1820	spoolsv.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "c:\\windows\\resources\\themes\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\resources\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "c:\\windows\\resources\\themes\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\resources\\svchost.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	lcb_spoof_crack.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcb_spoof_crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
6024	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3204	explorer.exe
1980	svchost.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
6056	lcb_crack.exe
6056	lcb_crack.exe
1984	lcb_spoof_crack.exe
1984	lcb_spoof_crack.exe
6024	icsys.icn.exe
6024	icsys.icn.exe
3204	explorer.exe
3204	explorer.exe
1172	spoolsv.exe
1172	spoolsv.exe
1980	svchost.exe
1980	svchost.exe
1820	spoolsv.exe
1820	spoolsv.exe
2044	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 1984	6056	lcb_crack.exe	89
PID 6056 wrote to memory of 5920	6056	lcb_crack.exe	90
PID 1984 wrote to memory of 3284	1984	lcb_spoof_crack.exe	91
PID 1984 wrote to memory of 6024	1984	lcb_spoof_crack.exe	92
PID 6024 wrote to memory of 3204	6024	icsys.icn.exe	93
PID 3204 wrote to memory of 1172	3204	explorer.exe	94
PID 1172 wrote to memory of 1980	1172	spoolsv.exe	95
PID 1980 wrote to memory of 1820	1980	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\lcb_crack.exe
"C:\Users\Admin\AppData\Local\Temp\lcb_crack.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
  "C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - \??\c:\users\admin\appdata\local\temp\lcb_spoof_crack.exe
    c:\users\admin\appdata\local\temp\lcb_spoof_crack.exe
    3⤵
    - Executes dropped EXE
    PID:3284
- - C:\Windows\Resources\Themes\icsys.icn.exe
    C:\Windows\Resources\Themes\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      4⤵
      Modifies visibility of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3204
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1172
      - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        6⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1820
- C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack1.exe
  "C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack1.exe"
  2⤵
  - Executes dropped EXE
  PID:5920

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcb_spoof_crack.exe

Path C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
Size 7.7MB
SHA256 c18160d02ee53d22242a534ba6a419baeb05d8193358110fae682dc408bd824c
MD5 6d2a43f7968244ed116f8a83a9021339
SHA1 adbc6f5a4ed8db905364ff2f0a9d747dfe6ba66b
SHA512 7492a756e2782b5aade62b4867ebfa5e6f4ca0df3b15be082e4c97b9db2489b15eb8fc5e2856ca353d1b7a73cfe72c30f70e142fb9644b05a8024dcffd317511
SSDEEP 196608:BkbgJsau4PqC1qLAgz27O7PNYODgH0ZW0dTqnc52b:WbgFu4PqC1qLAgh71rzZJ2ncC
TLSH
T15286E046A3E101F8D5B38238D45A431BF7B1741907719BCF32D44A522F63AE2AE7E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcb_spoof_crack.exe

Path C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack.exe
Size 7.6MB
SHA256 c38ce83359b11c63b187f1fe5d3c3a8ef2eac3377d67eada3299758f24d33cc5
MD5 c5c7253e68ea5d96ad86b7a99c465386
SHA1 1f6197326f53c231929f90b01d0afae65ae75c6d
SHA512 bf4221643f50ea2b9a3fd84e7c49219178f4e6d63b8f9e6505b512277534df945d7f0527d793981e37440abffdd78d93d04ac6a69532a64dea94a4e7e54355c9
SSDEEP 196608:BkbgJsau4PqC1qLAgz27O7PNYODgH0ZW0dTqnc52:WbgFu4PqC1qLAgh71rzZJ2nc
TLSH
T1F086E146A3E101F8D5B78238D45A031BE7B1741907319BCF27D44A522F63EE2AE7E729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcb_spoof_crack1.exe

Path C:\Users\Admin\AppData\Local\Temp\lcb_spoof_crack1.exe
Size 506KB
SHA256 f045c6f415145b6ce7014603aa6b91fbe17ebdd7e41d667ac31b73172fc7d84c
MD5 dfcd396e7e528bfb20968dfafe4e8b49
SHA1 332879b90cac1f8353a4a03e5e9ee439d342a6b2
SHA512 47cd2d0bef9fc89e094130fa6f9e43cf84c61ea15c3b150b68b8ff8a6af0ce61fee9058a0e8c79e12a6274c2ec076e57cfea68a952156f05343aece639dc93d9
SSDEEP 12288:jmiMZvN43+u85Bpw+YMRkc97aXUP44R3m:CnvS+55BpfRX97aX4RW
TLSH
T175B48D19D7E405F9E1B7E578CD834902E7767C494771E6CF03A4A9A61F232A08E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 4ab7e76760fd1dfc913828bc52821b885d8b04384a90412be0b0e131164e4ce7
MD5 372444c2feb04d262c824f2f47b1f7ab
SHA1 97915bc0512a82ff54df4aab948e8d8b1fb2bd48
SHA512 c38e634e39f2b0ced9564e424d5cf22f28750126eed5bb9bb040ac64278cbc7703e99d111e6610d42db06f47f00d20c25f4252fc2a72a45eddf98cb60d110684
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXP:UVqoCl/YgjxEufVU0TbTyDDalRP
TLSH
T145D32B237E50652FD8A2CDF178B6E619BD625E3617916F2772A6B7002AB104376F030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 f3166d575472c82f10b4712a3ec751b9e22271261b332d3ad8887407f8b05501
MD5 6a6b6d2f5f95d868dbe654d9b031e8c8
SHA1 cc6e12bc485aa306bd0b9fee8949de1acf647e13
SHA512 9fa8ec9372e62a0710f2447c31ba4c805284dec790c16d20b3052638597644493f61c9746cca0a54230eb7d9e707f5c8f7da01da7c224e812767060cbaaaac08
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXF:UVqoCl/YgjxEufVU0TbTyDDalRF
TLSH
T1DED32A237E90443BC42187F168B5EB6DF9266E3607E0AD177292BB0175B668376F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 094a5b3d5390e261f44d4aa49a828afb49621ab5c1a2aea0c3ead5affd41355c
MD5 7724e864f704fceb0809958b5af52293
SHA1 43c45458722021e04c623ccc628a20cd115a98e1
SHA512 ddbb8fb906d08f08b65bcc8d94401e6b8ddd0852a1470cdddc42e126dfe96f665b3ec3c75dda365101d7260557b7025b74dba6c3c74d92cf7728b28cb07a2c4f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXt:UVqoCl/YgjxEufVU0TbTyDDalRt
TLSH
T1E9D30923AF61142FE821C6F13869E639B9465E3E1BE0EE073265FB50357218336F521B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 4eeb675c2a1bb9f0b7bbb098532cc48ad0d30d5bc510e46d6c4a9bea5ffb55ea
MD5 a38a178591f2be3d01dab6251402c15f
SHA1 a2032d2ebe5cfbd3153220df35ceaf7d759eaea7
SHA512 9ea56bb8539deecd6422229084637618d3bd64053bb888ef7a4a5c7749f6bfcb8c20c98eb25ff24712ded5f0c80838bbe5205d367520a3b9233565d8859272b4
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXnIIIIIIIIIIIIh:UVqoCl/YgjxEufVU0TbTyDDalR5
TLSH
T186D32A27BE40507EE852CAF178E9EB2EB9A21E350BD06D0B76A5B705297118775F030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-71-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1820-70-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1980-74-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1984-41-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1984-15-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3204-73-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6024-72-0x0000000000400000-0x000000000041F000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads