eea0ac9ffe45fca8da15b34d4f0295d24070e82452c8d7bf6a0493a60f768d22

Analysis

user interaction
yes
max time kernel
33s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tlock_5.exe
Size 431KB
Sample260808-p3ccnsde92
SHA256 eea0ac9ffe45fca8da15b34d4f0295d24070e82452c8d7bf6a0493a60f768d22
MD5 2a6749a7735aef3ce1a81608787ee99f
SHA1 62548574856b5db99932a7291ad9363d5a011dfd
SHA512 be5b770e266b0c6aa58f09f9d64fd1017b8f9e93b0cb44f8b647f6048a59c57cbd26a2fdb2bb44d6b5f89ac819c91c02a7c5f79788620b06deaacc1a3e9b368f
SSDEEP 6144:WagK7xL1a+VgpCrn3IJfiEESFziUATm/iqPNqMSpCNzPiGYPYL37byPOHS9BzdV7:Dbm+OyRmiXTm/iERsEPiDs3nBS95fe
TLSH
T1E994238DA761EC37E44A48319D5904F03E217E31A9792838CE1E67934CB1A587F7C9BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution persistence upx

Malware Config

Signatures

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2496-0-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/2384-1-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/2384-4-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/2384-14-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/2316-18-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/3580-22-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/3304-26-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/5840-30-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/5276-34-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx
behavioral1/memory/4536-38-0x00007FF717910000-0x00007FF7179F2000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe
2448	schtasks.exe
1452	schtasks.exe
1844	schtasks.exe
4864	schtasks.exe
4524	schtasks.exe
5980	schtasks.exe
1952	schtasks.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4864	2496	tlock_5.exe	88
PID 2496 wrote to memory of 2384	2496	tlock_5.exe	90
PID 2384 wrote to memory of 4592	2384	tlock_5.exe	96
PID 4592 wrote to memory of 4524	4592	tlock_5.exe	97
PID 4592 wrote to memory of 2316	4592	tlock_5.exe	99
PID 2316 wrote to memory of 4064	2316	tlock_5.exe	102
PID 4064 wrote to memory of 5980	4064	tlock_5.exe	103
PID 4064 wrote to memory of 3580	4064	tlock_5.exe	105
PID 3580 wrote to memory of 5216	3580	tlock_5.exe	109
PID 5216 wrote to memory of 1952	5216	tlock_5.exe	110
PID 5216 wrote to memory of 3304	5216	tlock_5.exe	112
PID 3304 wrote to memory of 2712	3304	tlock_5.exe	115
PID 2712 wrote to memory of 4140	2712	tlock_5.exe	116
PID 2712 wrote to memory of 5840	2712	tlock_5.exe	118
PID 5840 wrote to memory of 2628	5840	tlock_5.exe	121
PID 2628 wrote to memory of 2448	2628	tlock_5.exe	122
PID 2628 wrote to memory of 5276	2628	tlock_5.exe	124
PID 5276 wrote to memory of 616	5276	tlock_5.exe	127
PID 616 wrote to memory of 1452	616	tlock_5.exe	128
PID 616 wrote to memory of 4536	616	tlock_5.exe	130
PID 4536 wrote to memory of 5964	4536	tlock_5.exe	133
PID 5964 wrote to memory of 1844	5964	tlock_5.exe	134
PID 5964 wrote to memory of 5548	5964	tlock_5.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4864
- C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
  "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 2496
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
    "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
      "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 4592
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4064
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 4064
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 5216
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 2712
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 2628
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 616
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --autolock
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn UserSessionSync /tr "\"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe\" --autolock" /sc onlogon /f /rl highest
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tlock_5.exe" --wd 5964
        16⤵
        
        PID:5548

C:\Users\Admin\AppData\Local\Temp\tlock_5.exe
"C:\Users\Admin\AppData\Local\Temp\tlock_5.exe"
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-36-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/1532-7-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2316-18-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2384-4-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2384-14-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2384-1-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2496-3-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2496-2-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2496-8-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2496-13-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2496-0-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2628-32-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/2712-28-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/3304-26-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/3580-22-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/4064-20-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/4536-38-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/4592-16-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/5216-24-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/5276-34-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/5840-30-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

memory/5964-40-0x00007FF717910000-0x00007FF7179F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads