b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56

Resubmissions

05/08/2026, 03:15

260805-dr7tnavsg18

05/08/2026, 03:13

260805-dq7r9scf698

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOCK.exe
Size 187KB
Sample260805-dr7tnavsg1
SHA256 b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56
MD5 8499e96009ed7f684a8854a4c44f1e32
SHA1 2170055dc72f796f7a185e4655dcfbb22b04c518
SHA512 7c74f6edd7885ce4b45871125a645be858ef25dfb0342132298da3a015a45ec87ee8a9e8a98d36fe336def3b2bfcb901b1eb551c505dde9b0a1f68559a1651f9
SSDEEP 3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPyoNdquWTD4xVictLu:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBE
TLSH
T1A8141896B1A45165C7F382B7E5204E2AD6713D601615A3E727783AFB1B3B294CB3C3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4820	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4820	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1684	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	powershell.exe
4820	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1684	4148	LOCK.exe	89
PID 1684 wrote to memory of 4196	1684	cmd.exe	91
PID 1684 wrote to memory of 292	1684	cmd.exe	92
PID 292 wrote to memory of 248	292	net.exe	93
PID 1684 wrote to memory of 4820	1684	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\LOCK.exe
"C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6A59.tmp\6A5A.tmp\6A5B.bat C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4196
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://i.ibb.co/RGFK3SSx/Gemini.png' -OutFile 'C:\Users\Admin\Pictures\wallpaper_new.jpg'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A5B.bat

Path C:\Users\Admin\AppData\Local\Temp\6A59.tmp\6A5A.tmp\6A5B.bat
Size 750B
SHA256 27de25693b38984a6d670dfbd12baa7044feb19da7b1ba269fe633194945fe81
MD5 8eb90c6406c8e54a2946160ca9c4b51f
SHA1 ba7574e93cb311cb70cf0944d727b2047cd9e73e
SHA512 942ef8ad0b9386531593be15987dfa9fe4dbc828f34b191403f36f501c6a8a2d9212e52305bb52c1af4996ba9e94643af2c2de6eddd4999a047e233ee8a55c9e
TLSH
T1F501B523300141794A22C568D8936023FEBA62DBB55A31CB30F0F1116E4FE1AD6F2A4D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4820-2-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp

Download

memory/4820-3-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-6-0x000001D4AC6F0000-0x000001D4AC712000-memory.dmp

Download

memory/4820-7-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-8-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-9-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-10-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-11-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-12-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-13-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-14-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-15-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-16-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-17-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-18-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-19-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download