Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 10:41
Behavioral task
behavioral1
Sample
757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe
- Size 233KB
- Sample260908-mrmcdseh77
- SHA256 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6
- MD5 1b706ad948b2cf0799f4c04ab06cd878
- SHA1 bdcd797ca39ab3918eee0b2dbb1dafc2118f1608
- SHA512 76f6e43c13a9bf21703133536b9d0ae57e284c917e86016d2bb64a22011f7cdc1966e8b67139525d3db84904b34d3489f0d3b4ad5ed96efe20d74a76918a6064
- SSDEEP 6144:Nh9wv1Ut3nh9wv1U3eRCisbwk2h8nBbCnh77rW:Nh9wtah9wtRsTbXU8nKhbW
- TLSH T1043413E9F8C104FAE292EE7F74183237B3A9D078694A86BA84FD3345158E6F51857C70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3296 lcss.exe - Modifies WinLogon 2 TTPs 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon lcss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" lcss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\crypto.dll 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe File opened for modification C:\Windows\SysWOW64\wlogon.dll 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe File opened for modification C:\Windows\SysWOW64\net.cpl 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe File opened for modification C:\Windows\SysWOW64\lcss.exe 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe -
resource yara_rule behavioral1/memory/5012-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000a000000024126-5.dat upx behavioral1/memory/3296-26-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000024209-25.dat upx behavioral1/files/0x0033000000016864-30.dat upx behavioral1/memory/5012-32-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000700000002420a-28.dat upx behavioral1/memory/3296-33-0x0000000000400000-0x0000000000420000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe - Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5012 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Token: SeDebugPrivilege 5012 757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe Token: SeTakeOwnershipPrivilege 3296 lcss.exe Token: SeDebugPrivilege 3296 lcss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe"C:\Users\Admin\AppData\Local\Temp\757da6b3d84ac65c6b1aa4c0812b12b1fe267f8da4530fa8aa2b5d9a5facc8d6.exe"1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
C:\Windows\SysWOW64\lcss.exeC:\Windows\SysWOW64\lcss.exe1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\crypto.dll
- Size 178KB
- SHA256 d979f3b7acdde0cb40746d4fed9fbe4b210cf3b81989aa4f2d336fe751a50c89
- MD5 a2bffb4d8d795b3939e32b7dfbdc1936
- SHA1 18624d787d9929d9daefef9185b90b7ee87189e7
- SHA512 d98d50aa95d211bf3c0a9ec7d81d749efc12cce035067091add642c7d5b9cb2afb2a0a839d5236982066e9c423cac64f9c882e7e7c5caedb2941a18214631664
- SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsBpRwViigrfym57GBjXv0N8aSKxZ:Nh9wv1Ut3nh9wv1U26i3f8X8aLK
- TLSH T1DD0412D7DC8255FEE642EABF194C722111B0483CDE67C9BC68BFB285D5AC0B408D3A59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\lcss.exe
- Size 176KB
- SHA256 eb78537be43935beafb9234cc794b1668595b0fb219dd7d6956b782d1f7b0928
- MD5 02778081ef0d9e10d705af59e8db658f
- SHA1 7d404b9b3defe14340605b995a7548af6bf6c698
- SHA512 302cc0d29157b12bfd380988a94a467560262203e3fb6c6392162c903af03f96a484cfdcf9cba0a7b70f47a53fd1f66c5d30993a89e9aada8b6fdd9bed2e277e
- SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsEOBYJFKTmWlM/Zn1Tcw7J5ncJh2:Nh9wv1U7h9wv1Ut3rKyWlYZn1TtuY
- TLSH T1800412EF98C041FAFF57E27FE59C346250B058389EA34EE61C9A33E5D65D0B81892D90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\net.cpl
- Size 137KB
- SHA256 332420b3c8fce2f1c49e4b4f09025ae57218f2530464838184ca3884085b6427
- MD5 66a0a154c70eada43e6451f18418ef70
- SHA1 c5fa381c1ce4e1a0d443fcdeb55519158df753e9
- SHA512 aa56cceab85ff3984a6adab7b34c78f07925b0de75ca8927a5a0ec20b0e053eb79bf79ee3b856ec53c5f02a90edb87f25b1a2c0d161c070f54d6f479c7f8d553
- SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsxmaSRvVL:Nh9wv1Ut3nh9wv1URRvVL
- TLSH T1E2D312B7F4C088BBE113E17B298D323125B448689A558AFB2DBBB3C5978D4B13C57D24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wlogon.dll
- Size 128KB
- SHA256 228838aee976da21299626d78d0f34abcb0f89db3181216a22d0ce9de40fe601
- MD5 752918082a11dd740bd404572dcbc886
- SHA1 db3cf121f785f91f50e08430e326b78444a86d11
- SHA512 96673017a839f3f076d5f6fa573e2922fbbebcdbc59fa8a2008537ef5c4477fa705ac1a11b960f923f249661783f8880b1680e33ea099fecb4827f99c30c37be
- SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1Us9AZTi:Nh9wv1Ut3nh9wv1U9w
- TLSH T11AD302B7F0C044A7E651F67F9D8C713165A894249B534AFB78BB33C6878D0B4189ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH