Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 17:07
Behavioral task
behavioral1
Sample
4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe
- Size 178KB
- Sample260910-vm5xyavyfz
- SHA256 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542
- MD5 1be482eb30e197bc84a920cf34f8e04c
- SHA1 92163cb96540fab7ae6b77f1e77ed30f484e88f1
- SHA512 7359a89a098637197fb459d1e3b4ebc78e319e889090fc5d7311c6273c43d3322734dad2d7d060d4497bb89606db687cc78fefb1271b6e2ed727db15bbeecba0
- SSDEEP 3072:IyrN/sVywaEj1UsjLGyrN/sVywaEj1UscPckDtGEnIB94tR5kDpuDYS:Nh9wv1Uozh9wv1Ud5GEI9E5kUYS
- TLSH T1C104223FD4C0489EE52BF3BF5C9E74556560D468A8144B2F6DEE3285C38D27A08A23F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4472 lcss.exe - Modifies WinLogon 2 TTPs 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wlogon.dll 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe File opened for modification C:\Windows\SysWOW64\net.cpl 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe File opened for modification C:\Windows\SysWOW64\lcss.exe 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe File opened for modification C:\Windows\SysWOW64\crypto.dll 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe -
resource yara_rule behavioral1/memory/4580-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000024496-5.dat upx behavioral1/memory/4472-27-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0007000000024497-26.dat upx behavioral1/files/0x0007000000024498-28.dat upx behavioral1/files/0x000f0000000243e0-30.dat upx behavioral1/memory/4580-32-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4472-34-0x0000000000400000-0x0000000000420000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe - Modifies registry class 38 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB} lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both" lcss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography" lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}" 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1 lcss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography" lcss.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4580 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Token: SeDebugPrivilege 4580 4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe Token: SeTakeOwnershipPrivilege 4472 lcss.exe Token: SeDebugPrivilege 4472 lcss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe"C:\Users\Admin\AppData\Local\Temp\4c03e8ee32c0fda211a829acbb3a182e479584e3f75d7597798daafdec3e3542.exe"1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
C:\Windows\SysWOW64\lcss.exeC:\Windows\SysWOW64\lcss.exe1⤵
- Executes dropped EXE
- Modifies WinLogon
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\crypto.dll
- Size 207KB
- SHA256 ef39fdcfce3305571e67ac33b58be320cf01d41fe9dd80ef48a3f7613782664d
- MD5 999a01a101043a7f91e39c26675b4a16
- SHA1 d3bcdce6e6c9a38ba7d1a9ae6f3e5bda3d3b496f
- SHA512 81c990abd8ee19059710b5e12bae818a1622422d5948b56e7a351ab8b1936a3131c9693b04ae78df74c461dcd6b52644a529d4a3d009759fe99a95d83c9c7bd2
- SSDEEP 6144:Nh9wv1Uozh9wv1U69XPhYrPF4EPOxvw+JqxIIN:Nh9wtpzh9wtJ9XPhYzF4VxoVIy
- TLSH T142241223E5C44D7EE267F3FB795C31101224B6352D868FAB3ABCA288C59D16204BE675
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\lcss.exe
- Size 154KB
- SHA256 22ccdbc9a56ee4dcb249bea2a9d46ae340588fa1e43bd535d47883d2aae043d3
- MD5 b4d0f2c6fff445c6c2ba65b145501f3d
- SHA1 705971ed7a245371f3a4a2ccbabacf79e1857cb4
- SHA512 3c93fd393a348ebe1dbf23a7c00e6d84f917369dac24298a37e25040fabe20197bf561532c102faed9205c6e717b724c8c9ac25ef30eaec72e78609470873666
- SSDEEP 3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsjLAkrySNAahrnPJWNwA:Nh9wv1U7h9wv1UoAcdNA0nRIwA
- TLSH T103F31213F886855EF707FBBF684E752194B1BC2426428F6F2CFE324AD28D1F904665A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\net.cpl
- Size 111KB
- SHA256 1c5e4be8e797b6b6989271b8c6f4ba3699773b85dbc1c3be57baded72b7b792c
- MD5 c257ea77d4abb7437adab1e4b03c1526
- SHA1 114fb819bf4a00752c493e7c96ecd9154545b877
- SHA512 20169597fa4441c47f90bd5a1d2a71eb50e8509fd95fce9d9834daea57d5c475fa8d7276f9eb64f01ffd2fa40fc1df8fc2d269581092f71de95845ab06cb7443
- SSDEEP 3072:IyrN/sVywaEj1UsjLGyrN/sVywaEj1Us7:Nh9wv1Uozh9wv1UG
- TLSH T108B3025BF0C180EEE753F7BF684D34219161246459518B7F28FE72CAD68E7B908A36B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wlogon.dll
- Size 215KB
- SHA256 047eedb7ec5d1653d3e61edb358afea6335c548062f8d279c9dfd3c8b81ba370
- MD5 8224a7f2a4c7a50ea6f12512e9ac1fae
- SHA1 70a51f3772370ee1c63e076b681243a693234c86
- SHA512 193f21f45835c9106cd6515bb3fe03c4125996d0152a2e6f85250e246ec660ac2692b829e0e0011399985cf594aab3417b91df137e3174875efb745435246bda
- SSDEEP 3072:IyrN/sVywaEj1UsjLGyrN/sVywaEj1Usx2A3yWbRc1+zI20aVjfK855yC/o:Nh9wv1Uozh9wv1UGKWbRc1+BVjSSK
- TLSH T1822412BEF0C281A9D342BBFFD8C4752252A120685B864F59056F33D7FE8F1AA005B575
- MD5 SHA1 SHA512 SSDEEP TLSH