Analysis
- user interaction
yes - max time kernel
66s - max time network
68s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lain.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lain.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target Lain.exe
- Size 2.0MB
- Sample261104-yn7dyaft8q
- SHA256 04d9234304472cf8396bdccea396a3231029429a72b90f214bc39c37c9728023
- MD5 5c3ab1094a53e235f21033300c7ef529
- SHA1 cb03a7321722e27cd7e4884dc9e878d1baf9a984
- SHA512 1a13fd23301838d091a5435a8240957e756fe65799ed36f5ef27b82671f2ed940f5fff33e259323545634d7918f561a18c2dd809cdae5931f13eb06340ea9418
- SSDEEP 49152:hY7xH8jKhbs8D5Vb7W4MJwhMgb0Br8sm893lbcKO:hY7xH8jKlsg5Fy7ab0Br8sRn4KO
- TLSH T1EFA533137AA8632ED07D5871C46C55B28532BF586B03CC0F37AAF23B7D61A849B6539C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lain.scr Lain.exe - Drops file in Program Files directory 54 IoCs
description ioc Process File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Link.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Computer One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Full Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Max.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Asterisk.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Exclamation.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain No.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Documents One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Two Closed.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Empty Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Exit2.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Debeep.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NESW.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Up.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Move.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Full One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Documents Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Wait.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Down.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Up.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Help.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Hor.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Network Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Webviews\Lain Left.gif Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain New Mail.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Cross.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Beam.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Computer Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain.Theme Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Critical.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Pen.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NWSE.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Wallpaper\Serial Experiments.jpg Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Start.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Webviews\Lain Logo.gif Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Exit.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Start.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NS.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Network One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Empty One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Open.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Two Open.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Start 2.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Min.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Arrow.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Closed.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Wallpaper\Lain.jpg Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Exit.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain Two.Theme Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Program.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Question.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Recycle.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Working.ani Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Busy.ani Lain.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\fonts\HARNGTON.TTF Lain.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lain.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "20" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Harrington (TrueType) Lain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Harrington (TrueType)\ = "HARNGTON.TTF" Lain.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1020 Lain.exe 1020 Lain.exe 620 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lain.exe"C:\Users\Admin\AppData\Local\Temp\Lain.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1020
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3978055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:620