b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOCK.exe
Size 187KB
Sample260809-qvrcasydjb
SHA256 b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56
MD5 8499e96009ed7f684a8854a4c44f1e32
SHA1 2170055dc72f796f7a185e4655dcfbb22b04c518
SHA512 7c74f6edd7885ce4b45871125a645be858ef25dfb0342132298da3a015a45ec87ee8a9e8a98d36fe336def3b2bfcb901b1eb551c505dde9b0a1f68559a1651f9
SSDEEP 3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPyoNdquWTD4xVictLu:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBE
TLSH
T1A8141896B1A45165C7F382B7E5204E2AD6713D601615A3E727783AFB1B3B294CB3C3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2220	powershell.exe
1888	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\wallpaper_new.jpg"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2124	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe
1888	powershell.exe
1888	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2124	3520	LOCK.exe	89
PID 2124 wrote to memory of 5168	2124	cmd.exe	91
PID 2124 wrote to memory of 6048	2124	cmd.exe	92
PID 6048 wrote to memory of 1868	6048	net.exe	93
PID 2124 wrote to memory of 2220	2124	cmd.exe	94
PID 2124 wrote to memory of 1888	2124	cmd.exe	96
PID 1888 wrote to memory of 5092	1888	powershell.exe	97
PID 5092 wrote to memory of 2636	5092	csc.exe	98
PID 2124 wrote to memory of 1412	2124	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\LOCK.exe
"C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5A2C.tmp\5A2D.tmp\5A2E.bat C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5168
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://i.ibb.co/RGFK3SSx/Gemini.png' -OutFile 'C:\Users\Admin\Pictures\wallpaper_new.jpg'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$code = '[DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);'; Add-Type -MemberDefinition $code -Name Wallpaper -Namespace Win32; [Win32.Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\Pictures\wallpaper_new.jpg', 3)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbnuamwi\vbnuamwi.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33B4.tmp" "c:\Users\Admin\AppData\Local\Temp\vbnuamwi\CSC775EE221F5493CB8DC8B24A97A767.TMP"
        5⤵
        
        PID:2636
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

5A2E.bat

Path C:\Users\Admin\AppData\Local\Temp\5A2C.tmp\5A2D.tmp\5A2E.bat
Size 750B
SHA256 27de25693b38984a6d670dfbd12baa7044feb19da7b1ba269fe633194945fe81
MD5 8eb90c6406c8e54a2946160ca9c4b51f
SHA1 ba7574e93cb311cb70cf0944d727b2047cd9e73e
SHA512 942ef8ad0b9386531593be15987dfa9fe4dbc828f34b191403f36f501c6a8a2d9212e52305bb52c1af4996ba9e94643af2c2de6eddd4999a047e233ee8a55c9e
TLSH
T1F501B523300141794A22C568D8936023FEBA62DBB55A31CB30F0F1116E4FE1AD6F2A4D
MD5 SHA1 SHA512 TLSH

Submit Download

RES33B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES33B4.tmp
Size 1KB
SHA256 2b4392cac9ef497fa8679f23618c35489d000f1d8c2447b0ee7a7b49ec51999d
MD5 c87fac6521843aed9f91cdac40b5079f
SHA1 3e1b0b05003fba78c2f87dc42d1a5c95294ccc05
SHA512 c3463d72a0f26c9746c7eb9546f8bf4f5c325b60c9f0b4b80d1099348cded800d40c5aedf15e63c018a1a3a6e80f414f76e005987cc3a8548f1e907a4762550d
TLSH
T1D121EB0593EC471EF0B307316AF6672F9274FDA8EFA2935A880002282C52144EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

vbnuamwi.dll

Path C:\Users\Admin\AppData\Local\Temp\vbnuamwi\vbnuamwi.dll
Size 3KB
SHA256 4905b5d819a6bc2c854120d1c3dddbc3f2ed051ecea26d7008434572f5ae0016
MD5 1a4a5b0f2b37d4069dfb07b3515d668a
SHA1 9d92ae468535929ed9302341ff27f4663679868d
SHA512 84ee50c097f9087fc5c4b7b4c0b647c7137fa6897bb22f509fe078d38195c3b8ca4b63b3cd010756fbcf45f6728617af03c5f9c55e30159d32137fa14a105292
TLSH
T1E551B02A63E8466BE4770B346EF3876637B8F864AFB2535D18D00328AC617645D71F70
MD5 SHA1 SHA512 TLSH

Submit Download

CSC775EE221F5493CB8DC8B24A97A767.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vbnuamwi\CSC775EE221F5493CB8DC8B24A97A767.TMP
Size 652B
SHA256 8e1e233dce0f6b698b5b929ec73fecb031d48572a772b33ae26bc32ee32c3391
MD5 f52cf17b405beef04898b9561e593e04
SHA1 a06b40178e73cbbe19ad0740787f9739dada068a
SHA512 ccc383f3e7aaf814812e2a3f82412664e98394cca2b2fedb64cb21749f4b6f53c30a43c67da2110f4f6876ae25a66387b7d07690ed21db8c8558f177c0105436
TLSH
T181F05E1963F8020EF0F34B30BEF693A391A9BC65DE7293ED1440031928646208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbnuamwi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vbnuamwi\vbnuamwi.0.cs
Size 274B
SHA256 21504fd073038a8709b2bcbf3556708c7c2b9dda80dba5af80158866fc22f6bf
MD5 1fd21394b33e86f5137153f93fafb2c8
SHA1 ffafab07693283f79c4cc3f5ca0d4fda5f93bbea
SHA512 6d80b1f74188a6165b4a7510abd8ae730b32c33e5d33108b766a9a5ade159cb3d81bfdd992f66ac090642430dbd4afc6350c6432cb3a2eba4e797c447c1b0489
TLSH
T17CD02B24B693DAF88443081B4C83A0B57737916B72DB7A0579F86110CF8B4182932A29
MD5 SHA1 SHA512 TLSH

Submit Download

vbnuamwi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vbnuamwi\vbnuamwi.cmdline
Size 369B
SHA256 a364dc684483667aeb43a3356663c3ec932b3e7ab21d9ca5570ff8d38050908f
MD5 eb6530a5f8a7b20d8c126d09b1b0a307
SHA1 0aa3c5e7a166ff00010dc4dc314ed0089a44ed25
SHA512 e4f71db3f3ba51430a493d7e85aabf9af669a7dba73ca81f603b30e2b298a4b9b2dcfc84288fd2db39ebeef1838ce5c6c96eab3ab910b1b36017ffe3fd2fe408
TLSH
T1D6E0C03E4246C3BE01DD260731E9C4ACDE7317432A403F8C5040440DD01780AE7E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1888-38-0x000001151BD80000-0x000001151BD88000-memory.dmp

Download

memory/2220-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-15-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-16-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-17-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-21-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-13-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-8-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-7-0x000002482CF90000-0x000002482CFB2000-memory.dmp

Download

memory/2220-4-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-3-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/2220-2-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download