0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Size 198KB
Sample260908-vvrehsfl7x
SHA256 0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2
MD5 c40f1d7bb7a867e0878ee5b8a7f4bbf8
SHA1 c376573269fc9fc0597342470dbacb74cf6ffa6f
SHA512 8f035d64c76cb51439ecb8b2515b89678668d775866c621a5a86a5f8031c1950b38b0e707093782c97425749daae1c4b91fffd53b7a4d9e8bdf5a5b1c698a6af
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsAw9wjV2iJd4pjJws+3LF1DW17oUnm:Nh9wv1Ut3nh9wv1Ud6wjaW1DWWUm
TLSH
T11F142367E88080B8D402FABF5C4C77A2F165A8596C42CF0B3DB63F67994D9F814E7560
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2536	lcss.exe

Modifies WinLogon 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	lcss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\crypto.dll	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3640-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x00080000000245e1-5.dat	upx
behavioral1/files/0x00070000000245e5-25.dat	upx
behavioral1/files/0x0018000000024408-29.dat	upx
behavioral1/memory/3640-31-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x00070000000245e6-27.dat	upx
behavioral1/memory/2536-32-0x0000000000400000-0x0000000000420000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	lcss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	lcss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	lcss.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3640	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Token: SeDebugPrivilege	3640	0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
Token: SeTakeOwnershipPrivilege	2536	lcss.exe
Token: SeDebugPrivilege	2536	lcss.exe

C:\Users\Admin\AppData\Local\Temp\0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe
"C:\Users\Admin\AppData\Local\Temp\0a7395ed9ba5c04b12487a0b73d90f034cadd8baed425e05fdba5d4e681d2fc2.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\SysWOW64\lcss.exe
C:\Windows\SysWOW64\lcss.exe
1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crypto.dll

Path C:\Windows\SysWOW64\crypto.dll
Size 120KB
SHA256 b6f083c25f9d106fe9d24bc87351f06d810240b78db899afb082d224ba634fa7
MD5 873f91ea07a0afdb090b1048a40cc3c3
SHA1 659332b4385986bac826920b4738dec0aa65a782
SHA512 2a21d52cd5ced8b261315c1f0075afb5c1daa9093e6a87780f94ee95cd5b48c9e02a6c2e73b4c884025005b412b810955b12e0458bca70c3b2e9b6f8ccae814a
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsH3:Nh9wv1Ut3nh9wv1UK
TLSH
T121C302A7E8C088FBF602F67F9C8C753165F058249B12466F29BE73C5968D47D08A7A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 205KB
SHA256 9fb3165d9d1c580f111fc88dff4a441e540f11e0fbd619d4452d3afe3c9a8d88
MD5 9550e2b4e7c967e83e54638793cdceae
SHA1 0d5eb5223e5e7d846e586e8d4f99290c6db86cd6
SHA512 6524e61662db6e39a2eedf09839e6e0fc8ae9c528b328231f24c75e178ff62f69339248c3db81904489948fe6604438838fbd8b4753fb61fdf778203ebcf7e30
SSDEEP 6144:Nh9wv1U7h9wv1Ut3abOZD6crj8Z689jl04:Nh9wtMh9wtA6crj8s8X04
TLSH
T166242267E4C261B5FB81F1FF69483026AAE09C64AB66C12B3CFD33D6A58D6601C53D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 168KB
SHA256 720f603c2f148addd71f3aebe67e2f2ef38a7e0b45ffa09fd2e312829e5961a0
MD5 dc8ed1e5c53dc586a35c040a4a2a10e9
SHA1 3f21f318d1c317eaed878cf79fea63aea5824a37
SHA512 f2f01a82169ba0bfc44a31417683db4ad8780fe7366553e7ce636db4eedda4c041e8a74d6dd709c20025a48024c371ec1a0c9305920d85c18b85a8e8c1112154
SSDEEP 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1Us3pVTPpFhFEvISbvme1Se7BV1nQB:Nh9wv1Ut3nh9wv1UwrfhqQpe1nlVRQB
TLSH
T12AF3129FE8C058BBE123D9BF5D4C7122D2F574758E129AFA642D33C5958E0B90CAB870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlogon.dll

Path C:\Windows\SysWOW64\wlogon.dll
Size 216KB
SHA256 1b4324c46b701e8b9f67120f62145df2f3a5fe7de2b548e321096a9d5e5f4565
MD5 c63cdb736a0b8dcb1d8fb336208d90c1
SHA1 3ade448291a26d689686331bff72124f498f7e2c
SHA512 b4ff3109d8b09d787476bd18e691cae85b6403c5f211c16802c948c6bdf29d39814d5edba192c70cf6520dbf2cdc6f7409ab826903412a1d48c71ba3fb30b4d0
SSDEEP 6144:Nh9wv1Ut3nh9wv1U/fGdSkx2kr/5pXL+HQmymiSV:Nh9wtah9wtpotC5pbzDSV
TLSH
T1F0241267E1C8A87AF317F7FF598C361221D1E92D97888F8959AE33D6544CE740427A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2536-32-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3640-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3640-31-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads