099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Size 223KB
Sample260908-vbprksvdlb
SHA256 099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c
MD5 af4f2a122301b91011b1cfa6126b1ea1
SHA1 b71519948f7cc65fb4be8b9d09120adba4655297
SHA512 e51755e6abb398e6b9982c3868a5d2102f61ca99c38935276b3b822f3a81c3e3d2766ff7350fa7e644887b5630e5841be92005a41553a33d55cc92b1f38c4e12
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsYFtgJ8fqO+jkxuPqQ9RefO46nFa9D:Nh9wv1Ut3nh9wv1Uz/gcqO++Q974kE
TLSH
T1D124223798C0913FF067F6BF5B8C2823BCE56498CA154BB58EB631CA848D9A51CE3471
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2496	lcss.exe

Modifies WinLogon 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
File opened for modification	C:\Windows\SysWOW64\crypto.dll	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3320-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x00130000000241e5-5.dat	upx
behavioral1/files/0x0007000000024258-26.dat	upx
behavioral1/files/0x000b000000023f94-29.dat	upx
behavioral1/memory/3320-31-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0007000000024259-27.dat	upx
behavioral1/memory/2496-33-0x0000000000400000-0x0000000000420000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3320	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Token: SeDebugPrivilege	3320	099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
Token: SeTakeOwnershipPrivilege	2496	lcss.exe
Token: SeDebugPrivilege	2496	lcss.exe

C:\Users\Admin\AppData\Local\Temp\099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe
"C:\Users\Admin\AppData\Local\Temp\099c38613cd37415edcca99bed4e376eee18ce3aadbd605ac2015efdb668ee7c.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\SysWOW64\lcss.exe
C:\Windows\SysWOW64\lcss.exe
1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crypto.dll

Path C:\Windows\SysWOW64\crypto.dll
Size 225KB
SHA256 c85ec07f69ee18f815f62aa8f1a3872bbda9e82b823172adfe237bb1ea1a03b2
MD5 21e29b5104b766f7bf1f606d69c864a1
SHA1 30838092c4c056b535e2b1323becbc98ea4737c6
SHA512 fc3136fae4d6a4acb1f83f51d81c1df61d9c0a70eb6e8d0bd351a7439cf9f8fcf4c0752dd0273e793f2ffe88e27bd4e1c214e52efa1e9830e1d7fcdc84589104
SSDEEP 6144:Nh9wv1Ut3nh9wv1UbQ6tWhFoSIRGGVQki:Nh9wtah9wtdTojGGVQ3
TLSH
T15934228FD49184A7EA62FEBFA4CC61B576F489648F42017F5DB63786E84C9E10DC3260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 198KB
SHA256 21931189886625b81100ebbd8ada47153744272e9ed62073c2f43cefcfe09b9f
MD5 f5b398ab58b77723402564e825b5de91
SHA1 ec8de6ce3d07a785e6ca4ac43c7e469a824340dd
SHA512 ecc8920311eb357218644298ae9503c347e33868c5beff715c0791cbc37fec68912d38161137312ef280bd546b6252b3d42bbf2b16baa771ded921a3e557cbc2
SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsEOBYJ81lchbHsh9PNCoCz68qh1nZwT:Nh9wv1U7h9wv1Ut3q1Chjsh9PIz6rVg
TLSH
T1B31412E2F481417BF253F6BF354DFA7192616C641E568AA520BA32CFCACC4B414E3CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 143KB
SHA256 13bb2cd5e2e1b37b82666cc81ad6425368621fc2b4091a0b6b1a2af207bb1e2c
MD5 8c13c151c4c9177f3677a676cf608fe1
SHA1 0e67cbd6aca282f114ed7e7f18b313d02e67f898
SHA512 a0de9acac881f8fdf52d82ecc00d83fe6e005a47accf45c91b64fab2672294969d6de4b98faefab2f0ebb0c49a557d2a2e588ed8a1b725cc6df3cef2cfbe0c00
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsDn84iHbtn6vbfwE:Nh9wv1Ut3nh9wv1U/HbYjr
TLSH
T1BAE312ABE88084FBF057F5FF784D35217195D8684B4E86AA68B673C6938D5F00493AF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlogon.dll

Path C:\Windows\SysWOW64\wlogon.dll
Size 196KB
SHA256 aae813c7d670f4cb32ec68ed8f4cf6072f296070f2c0cbaa0114ea835a499ae8
MD5 0769560d495826c52aa4dd4694d14d49
SHA1 b70be7716b629694c9bc2257d0d14d37771f9c92
SHA512 4e30121d403fbce3f9dc669eef25ef08cc8e693944c5a2deb2ce389a5efd57740e7e68b192c9e04f698ed3033196844fcbf38383997716c56de26e285885e74b
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UspsFShuneCcNaa5sFWCOl6O6KtLmR:Nh9wv1Ut3nh9wv1UUGeCzMzl6OfaR
TLSH
T1F8141337E481C9B7F5A3B97D5D8C3111A2A4957C6B4581EF3CA8B38DC18E0BD18A79B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-33-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3320-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3320-31-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads