Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lain.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lain.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Lain.exe
- Size 2.0MB
- Sample261104-yn7dyaft8q
- SHA256 04d9234304472cf8396bdccea396a3231029429a72b90f214bc39c37c9728023
- MD5 5c3ab1094a53e235f21033300c7ef529
- SHA1 cb03a7321722e27cd7e4884dc9e878d1baf9a984
- SHA512 1a13fd23301838d091a5435a8240957e756fe65799ed36f5ef27b82671f2ed940f5fff33e259323545634d7918f561a18c2dd809cdae5931f13eb06340ea9418
- SSDEEP 49152:hY7xH8jKhbs8D5Vb7W4MJwhMgb0Br8sm893lbcKO:hY7xH8jKlsg5Fy7ab0Br8sRn4KO
- TLSH T1EFA533137AA8632ED07D5871C46C55B28532BF586B03CC0F37AAF23B7D61A849B6539C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lain.scr Lain.exe - Drops file in Program Files directory 54 IoCs
description ioc Process File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Start 2.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Webviews\Lain Logo.gif Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Exclamation.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Working.ani Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Beam.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NWSE.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Move.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Computer One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Empty One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Documents One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Question.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Recycle.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Network One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Closed.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Empty Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Wallpaper\Lain.jpg Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Wait.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Critical.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Busy.ani Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Cross.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Open.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Full Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Documents Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Network Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Up.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain No.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NESW.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Link.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Wallpaper\Serial Experiments.jpg Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Min.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Down.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Recycle Full One.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Two Open.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Start.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Webviews\Lain Left.gif Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Program.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Max.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Exit.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Arrow.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Hor.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain Two.Theme Lain.exe File created C:\Program Files\Plus!\Themes\Lain.Theme Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Debeep.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain New Mail.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Help.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Up.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Computer Two.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Icons\Lain Two Closed.ico Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Exit2.sys Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Asterisk.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Sounds\Lain Start.wav Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain Pen.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Cursors\Lain NS.cur Lain.exe File created C:\Program Files\Plus!\Themes\Lain\Logos\Lain Exit.sys Lain.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\fonts\HARNGTON.TTF Lain.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lain.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Harrington (TrueType) Lain.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Harrington (TrueType)\ = "HARNGTON.TTF" Lain.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 Lain.exe 2984 Lain.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lain.exe"C:\Users\Admin\AppData\Local\Temp\Lain.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2984