575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Size 120KB
Sample260831-vyqbmaxdnd
SHA256 575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7
MD5 93d829d71fd3188c9dc7c38d79f01d29
SHA1 3c823833a13f8a3eaeedd0b3e93a6d33a9341a2e
SHA512 e498c36646157c00b23d83fe3be371bed0466a0a04ec6d509e07b5336a043f379e920c16c304e7e6472de5f3767943b84c568df248491237a94b1b753f32b7bf
SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsEOBYJcjvJvf9:Nh9wv1U7h9wv1Ut32j99
TLSH
T1C6C302B7E4C084BBF742F67F698C303171B044246B968AAF68BA73D5868D57508DBA70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4520	lcss.exe

Modifies WinLogon 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	lcss.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
File opened for modification	C:\Windows\SysWOW64\crypto.dll	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0008000000024564-5.dat	upx
behavioral1/files/0x0007000000024569-25.dat	upx
behavioral1/memory/856-28-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0005000000023299-31.dat	upx
behavioral1/files/0x000700000002456a-29.dat	upx
behavioral1/memory/4520-33-0x0000000000400000-0x0000000000420000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	lcss.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	856	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Token: SeDebugPrivilege	856	575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
Token: SeTakeOwnershipPrivilege	4520	lcss.exe
Token: SeDebugPrivilege	4520	lcss.exe

C:\Users\Admin\AppData\Local\Temp\575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe
"C:\Users\Admin\AppData\Local\Temp\575c0ec72d769f2d2943484f522bf4c2a6d23725d1a9ff66d7b1d8b6ba3dfcf7.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\SysWOW64\lcss.exe
C:\Windows\SysWOW64\lcss.exe
1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crypto.dll

Path C:\Windows\SysWOW64\crypto.dll
Size 130KB
SHA256 c75e18b0313f59c8080645e43db3b8f2e390de500d7cd60effaac5a8c3fa1272
MD5 88c14c8e7fb81ac4ce8f45135f7bcb43
SHA1 6a3b6377fc0551340509017770dbaa06db18cbc2
SHA512 12deb6798d8ad115c5eef0afaebf537a2092a8a9751353540e71dba15f2d0e6bd8cd7d9708a0b1bd1752b199f5a8c91dc7b0cd2e0bc3f20a4cea54a462e82032
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1Usreu6gxx96:Nh9wv1Ut3nh9wv1UYV646
TLSH
T1BCD31267E8C0957EF343E27FB88C313591A4586C6B1286AB18FA73C6934EAB418D7570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 129KB
SHA256 28cfa882e5839935ef240aa89a7ae16290cd72db3ab814b535acacbc2c61bb9d
MD5 0a439b10758f84230b63e60959af346b
SHA1 0ecac8da635a5ba457a5a31ec0acd077a73edbb2
SHA512 17fb6ad027d64f98f6082ebed243b7ccf89c72832f4ac1a31b5b755f72d3fcff3e9cbdb6ccf2dd3a8d525d935f04e9773cf5899efda7f21657c7eec22ed2f2ae
SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsEOBYJXNKLuNw8i:Nh9wv1U7h9wv1Ut3WTn
TLSH
T1D8D312A7F8C049BEF446F77F6C8C723156A1182C9656CBBB293D3386964E4BC0CA7560
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 135KB
SHA256 e7a1612f1a94a041dc0a1a8706e5409da969de3a23870d7c0253adbb3037dd7c
MD5 468bc15f781aeb44623b53cd4c8e9524
SHA1 4712b87c775e95f705ec625d29b97a547a72b8fc
SHA512 18fd5e4812e23e5a643862fbd70568e94c0ee7c136dcc2e792e7752eb15f0bee6aa533dbb20a4d9cf19280c37a3b00cd661d8d8967b74c2098c290c69e4fe574
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1Usee0qlWoDxKE:Nh9wv1Ut3nh9wv1U1e0IW4
TLSH
T1D2D312A7F4C0A4BBF507F33F69CC352594B468149E568A6B697A33C9924D07C188BDF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlogon.dll

Path C:\Windows\SysWOW64\wlogon.dll
Size 202KB
SHA256 5960fc910a92b84038a21d1531c8887ba6b60dbf9b4f26f62cbfb66915fe8ae4
MD5 645bbb75d4b32616b6878a1087bdbe49
SHA1 47b62c93783a85f5be68606dd0f3ba6c4dd4cb43
SHA512 ae026045daffc9f440af818d7281634c8b13b202d9f2de22026f1c9d19a2362c0c6cdc94934e55febdf710be919c1b5fe7547662ebb7840bd9a9924b11138c2b
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsLwLU5SArZWyrTajDf2Xee/Gam/:Nh9wv1Ut3nh9wv1UfPrIeeeam/
TLSH
T1B3141277E481947BF943AE7B64DCA9224A90893C8395467A387E33D6478C9A508FBC34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/856-28-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4520-33-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads