Analysis
- user interaction
yes - max time kernel
18s - max time network
37s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
21/06/2026, 05:55
General
- Target mylockbox_setup.exe
- Size 10.7MB
- Sample260621-gmnf1acw21
- SHA256 b1f0378982d8cc9388b3a424da6d6e0d91986fd582af03e6b330b63bfe210db1
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Creates new service(s) 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 3 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mylockbox_setup.exe"C:\Users\Admin\AppData\Local\Temp\mylockbox_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JJ627.tmp\mylockbox_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-JJ627.tmp\mylockbox_setup.tmp" /SL5="$801CC,10216851,845824,C:\Users\Admin\AppData\Local\Temp\mylockbox_setup.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create FSProFilter2 binPath= System32\Drivers\FSPFltd2.sys Type= filesys start= boot DisplayName= "FSPro File Filter 2" group= "FSFilter Content Screener" depend= FltMgr tag= yes3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\fltMC.exe"C:\Windows\System32\fltMC.exe" load FSProFilter23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\My Lockbox\mylbx.exe"C:\Program Files\My Lockbox\mylbx.exe" /setup3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\My Lockbox\mylbx.exe"C:\Program Files\My Lockbox\mylbx.exe" /f1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\My Lockbox\mylbx.exe"C:\Program Files\My Lockbox\mylbx.exe" /cp1⤵
-
C:\Program Files\My Lockbox\mylbx.exe"C:\Program Files\My Lockbox\mylbx.exe" /cp1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
FSPFlt2.dll
mylbx.exe
mylockbox_setup.tmp
memory/2252-0-0x00000000009C0000-0x0000000000A9C000-memory.dmp
memory/2252-7-0x00000000009C0000-0x0000000000A9C000-memory.dmp
memory/2252-161-0x00000000009C0000-0x0000000000A9C000-memory.dmp
memory/2884-257-0x0000000004250000-0x0000000004251000-memory.dmp
memory/2884-251-0x0000000004240000-0x0000000004241000-memory.dmp
memory/2884-239-0x0000000003450000-0x0000000003451000-memory.dmp
memory/2884-258-0x0000000004250000-0x0000000004251000-memory.dmp
memory/2884-303-0x00000000042B0000-0x00000000042B1000-memory.dmp
memory/2884-164-0x0000000000400000-0x000000000168B000-memory.dmp
memory/2884-259-0x0000000004250000-0x0000000004251000-memory.dmp
memory/2884-265-0x0000000004260000-0x0000000004261000-memory.dmp
memory/2884-266-0x0000000004260000-0x0000000004261000-memory.dmp
memory/2884-285-0x0000000004280000-0x0000000004281000-memory.dmp
memory/2884-307-0x0000000000400000-0x000000000168B000-memory.dmp
memory/2884-267-0x0000000004260000-0x0000000004261000-memory.dmp
memory/2884-273-0x0000000004270000-0x0000000004271000-memory.dmp
memory/4220-175-0x0000000075A60000-0x0000000075A61000-memory.dmp
memory/4220-168-0x0000000001BA0000-0x0000000001BA1000-memory.dmp
memory/4220-203-0x0000000004260000-0x0000000004261000-memory.dmp
memory/4220-202-0x0000000004260000-0x0000000004261000-memory.dmp
memory/4220-197-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4220-196-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4220-195-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4220-194-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4220-189-0x0000000004240000-0x0000000004241000-memory.dmp
memory/4220-188-0x0000000004240000-0x0000000004241000-memory.dmp
memory/4220-187-0x0000000004240000-0x0000000004241000-memory.dmp
memory/4220-186-0x0000000004240000-0x0000000004241000-memory.dmp
memory/4220-181-0x0000000004230000-0x0000000004231000-memory.dmp
memory/4220-180-0x0000000004230000-0x0000000004231000-memory.dmp
memory/4220-233-0x00000000042A0000-0x00000000042A1000-memory.dmp
memory/4220-232-0x00000000042A0000-0x00000000042A1000-memory.dmp
memory/4220-227-0x00000000777A0000-0x00000000777A1000-memory.dmp
memory/4220-221-0x0000000076D60000-0x0000000076D61000-memory.dmp
memory/4220-214-0x0000000004270000-0x0000000004271000-memory.dmp
memory/4220-215-0x0000000004270000-0x0000000004271000-memory.dmp
memory/4220-174-0x0000000075A60000-0x0000000075A61000-memory.dmp
memory/4220-165-0x0000000001BA0000-0x0000000001BA1000-memory.dmp
memory/4220-167-0x0000000001BA0000-0x0000000001BA1000-memory.dmp
memory/4220-209-0x0000000075A70000-0x0000000075A71000-memory.dmp
memory/4220-169-0x0000000001BA0000-0x0000000001BA1000-memory.dmp
memory/4220-160-0x0000000000400000-0x000000000168B000-memory.dmp
memory/4220-311-0x0000000000400000-0x000000000168B000-memory.dmp
memory/4308-8-0x0000000000980000-0x0000000000CC3000-memory.dmp
memory/4308-9-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/4308-5-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/4308-159-0x0000000000980000-0x0000000000CC3000-memory.dmp
memory/4568-460-0x0000000000400000-0x000000000168B000-memory.dmp
memory/4568-392-0x00000000018B0000-0x00000000018B1000-memory.dmp
memory/4568-369-0x0000000000400000-0x000000000168B000-memory.dmp
memory/4948-348-0x0000000004150000-0x0000000004151000-memory.dmp
memory/4948-349-0x0000000004150000-0x0000000004151000-memory.dmp
memory/4948-347-0x0000000004150000-0x0000000004151000-memory.dmp
memory/4948-341-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4948-340-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4948-339-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4948-333-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4948-355-0x0000000004160000-0x0000000004161000-memory.dmp
memory/4948-386-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/4948-367-0x0000000004170000-0x0000000004171000-memory.dmp
memory/4948-314-0x0000000000400000-0x000000000168B000-memory.dmp
memory/4948-463-0x0000000000400000-0x000000000168B000-memory.dmp