Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 07:49
Behavioral task
behavioral1
Sample
69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe
- Size 219KB
- Sample260908-jnshfstycs
- SHA256 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0
- MD5 426cfb7d890de26148bbb2510af98711
- SHA1 ec13c7fda21d1648e9693a49c8e1bf092821527e
- SHA512 9acf25e256136ff93654935cde59b2cf0145ff738afd133b5d20c71e600960e93facc45facb19953e906aee365fc5b0e49ebc738fe05fdfcaef2ab8e8cb6f157
- SSDEEP 6144:Nh9wv1Uveh9wv1UWsEpfA8e79RDC+1gwiHYRS7O:Nh9wt4eh9wt+BRDCkx0q
- TLSH T122241223FAC1446EFE6786BE04DD687291AABC3862114E6354DF7386658F0911CF6EB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3516 lcss.exe - Modifies WinLogon 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" lcss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" lcss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon lcss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\net.cpl 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe File opened for modification C:\Windows\SysWOW64\lcss.exe 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe File opened for modification C:\Windows\SysWOW64\crypto.dll 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe File opened for modification C:\Windows\SysWOW64\wlogon.dll 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe -
resource yara_rule behavioral1/memory/3860-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0008000000024361-5.dat upx behavioral1/files/0x0007000000024365-25.dat upx behavioral1/memory/3516-27-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000b00000002428e-30.dat upx behavioral1/memory/3860-32-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000024366-28.dat upx behavioral1/memory/3516-34-0x0000000000400000-0x0000000000420000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe - Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" lcss.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3860 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Token: SeDebugPrivilege 3860 69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe Token: SeTakeOwnershipPrivilege 3516 lcss.exe Token: SeDebugPrivilege 3516 lcss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe"C:\Users\Admin\AppData\Local\Temp\69655eec5f668c99f0cc5ef17919bc13cbd0ac2a6372bd9453d0f10c9bf21ac0.exe"1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
C:\Windows\SysWOW64\lcss.exeC:\Windows\SysWOW64\lcss.exe1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\crypto.dll
- Size 157KB
- SHA256 3c2be0db22acf6ac3559e3518a015293c20f5a3e3163d420e87ac4c8c586ef43
- MD5 7cbe06a3ba70ff807f774072a95397d8
- SHA1 ca608ee902f73cf81fedda448e16098c41b2cf64
- SHA512 cdb80d31a5953eb2e6de17a4d31e75a6f52482acb6780cc5128ac6e87ced0ad77c04e3a4c985fb780db55e4415c797d19b22f34d512d40ef70d892dff6b040d9
- SSDEEP 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1Us7Bl5wWqmikBkKS7X9qD:Nh9wv1Uveh9wv1UO5wgi/Z7kD
- TLSH T196F312FBE48249BAF627E37F480D79506262796423418BEF1DAF23C7E58E6712493530
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\lcss.exe
- Size 114KB
- SHA256 6bec0a3ae5667a73908875766383601305dcc4756a36db4709305d6f37b9514b
- MD5 b0adadddadf6682ec4a478bbf10f626c
- SHA1 bdbdbbd49ee8d3c45fbe142a7afc4e828eed1f69
- SHA512 00c7573667fbdc421601d0a0838ed1345e0c88b4fcea22cb7f444d1d496fa9c5b283f268bd87f3ee2b97b5c220560471e913028bbb256954b87128a2a2a926b9
- SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1Us10nf6IQoF:Nh9wv1U7h9wv1UvJQoF
- TLSH T14FB30257E0C1843EFA53FB7F681EB011929568685A438F6B10FF3386D74E5B518A3AB0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\net.cpl
- Size 173KB
- SHA256 3e92155157af777f744694d6888b8267d9db1c5d29e8f70706f331e1ed7bbbd7
- MD5 1570b3a37a3e77d8e4590480dc471ead
- SHA1 fbd65484bc33b7728cb11ba41dca93001508a288
- SHA512 7b1268634ec07ed448f601053909ec1469d70d78692d2c1b474f1c4f1b04708f04e4c3909e6bd8e37539f0fd0e9e5231ad343d810507373c0a220da9e9bcbc07
- SSDEEP 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1UsV7R/AMlTS4EO6wSBn2mV0lu888:Nh9wv1Uveh9wv1UwN/A431S0E0lb
- TLSH T1FB041207F40156B6E6C7FF7F982D750191858C4C55520AAEA4AE3387BECE4F618E39B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wlogon.dll
- Size 113KB
- SHA256 e096ab6c051efbbf499a22aa3f0b140befb5dc389b1719b174bea41584f0f1ee
- MD5 623a9244c0770d2f009d592651107970
- SHA1 4498e5a277bbd72c9e560a78f5b07ae8beecb962
- SHA512 4517510c3287fdd214a05476514fcb341319bc864296de88af28b4cabf46729d1d9bfc42256430a7a34a2a8a380e713fc3b446dc8ee6a2cc71b04d82833f65cb
- SSDEEP 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1UsxYW:Nh9wv1Uveh9wv1Uuz
- TLSH T1FDB30267F4C0847EF643FBBF581D7551929178686A428F2B14FE338A978E5B40893EB0
- MD5 SHA1 SHA512 SSDEEP TLSH