Resubmissions
06/05/2026, 21:07
260506-zyd1taez3m706/05/2026, 21:01
260506-zt2w3sey5j706/05/2026, 20:55
260506-zqg3haex3q706/05/2026, 20:43
260506-zhktesev2k7Analysis
- max time kernel
155s - max time network
158s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 20:43
General
- Target Lock.Julie.exe
- Size 5.9MB
- Sample260506-zhktesev2k
- SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Modifies Control Panel 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y35qrjgm\y35qrjgm.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1373.tmp" "c:\Users\Admin\AppData\Local\Temp\y35qrjgm\CSCBCB79BC1796242C1A82AD2023DD2886.TMP"3⤵
-
-
-
C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nagomivs\nagomivs.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D6.tmp" "c:\Users\Admin\AppData\Local\Temp\nagomivs\CSCD4FFA8966CEC4B488D8CA0E43F44E8FF.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.dscfg
SyncService.exe
bg_extracted.jpg
ModuleAnalysisCache
RES1373.tmp
RES41D6.tmp
__PSScriptPolicyTest_dm3htlt3.azd.ps1
nagomivs.dll
y35qrjgm.dll
CSCD4FFA8966CEC4B488D8CA0E43F44E8FF.TMP
nagomivs.cmdline
CSCBCB79BC1796242C1A82AD2023DD2886.TMP
y35qrjgm.0.cs
y35qrjgm.cmdline
memory/3440-41-0x000000001EDD0000-0x000000001EDEC000-memory.dmp
memory/3440-31-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/3440-39-0x000000001ECE0000-0x000000001ED93000-memory.dmp
memory/3440-40-0x000000001EDA0000-0x000000001EDAA000-memory.dmp
memory/3440-0-0x0000000000910000-0x0000000000EF4000-memory.dmp
memory/3440-44-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/3440-43-0x00000000031B0000-0x00000000031B8000-memory.dmp
memory/3440-42-0x0000000002FF0000-0x0000000003002000-memory.dmp
memory/3440-45-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/3440-46-0x000000001F2C0000-0x000000001F482000-memory.dmp
memory/3440-47-0x000000001F9C0000-0x000000001FEE8000-memory.dmp
memory/3440-38-0x000000001ECC0000-0x000000001ECDC000-memory.dmp
memory/3440-24-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/3440-23-0x000000001BC20000-0x000000001BC28000-memory.dmp
memory/3440-7-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/3440-8-0x000000001BBE0000-0x000000001BC02000-memory.dmp
memory/3440-77-0x000000001BC10000-0x000000001BC20000-memory.dmp
memory/4148-74-0x0000000002BC0000-0x0000000002BC8000-memory.dmp
memory/4148-80-0x0000000002A50000-0x0000000002A58000-memory.dmp
memory/4148-79-0x0000000001060000-0x0000000001072000-memory.dmp
memory/4548-72-0x00000153E1E10000-0x00000153E1E18000-memory.dmp
memory/4548-71-0x00000153E2000000-0x00000153E205D000-memory.dmp
memory/6040-20-0x000001F8317E0000-0x000001F83183D000-memory.dmp
memory/6040-21-0x000001F831600000-0x000001F831608000-memory.dmp