b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOCK.exe
Size 187KB
Sample260813-e6v9vabk8t
SHA256 b79adf6953a2dfc07dd4db69524932bd19a4631958e8a3cac66c63073b576f56
MD5 8499e96009ed7f684a8854a4c44f1e32
SHA1 2170055dc72f796f7a185e4655dcfbb22b04c518
SHA512 7c74f6edd7885ce4b45871125a645be858ef25dfb0342132298da3a015a45ec87ee8a9e8a98d36fe336def3b2bfcb901b1eb551c505dde9b0a1f68559a1651f9
SSDEEP 3072:PV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPyoNdquWTD4xVictLu:Ct5hBPi0BW69hd1MMdxPe9N9uA069TBE
TLSH
T1A8141896B1A45165C7F382B7E5204E2AD6713D601615A3E727783AFB1B3B294CB3C3E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2324	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2324	powershell.exe
5544	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\wallpaper_new.jpg"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2324	powershell.exe
2324	powershell.exe
5544	powershell.exe
5544	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	5544	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1236	1136	LOCK.exe	89
PID 1236 wrote to memory of 5756	1236	cmd.exe	91
PID 1236 wrote to memory of 1968	1236	cmd.exe	92
PID 1968 wrote to memory of 5800	1968	net.exe	93
PID 1236 wrote to memory of 2324	1236	cmd.exe	94
PID 1236 wrote to memory of 5544	1236	cmd.exe	96
PID 5544 wrote to memory of 5668	5544	powershell.exe	97
PID 5668 wrote to memory of 472	5668	csc.exe	98
PID 1236 wrote to memory of 4304	1236	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\LOCK.exe
"C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5B55.tmp\5B66.tmp\5B67.bat C:\Users\Admin\AppData\Local\Temp\LOCK.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5756
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://i.ibb.co/RGFK3SSx/Gemini.png' -OutFile 'C:\Users\Admin\Pictures\wallpaper_new.jpg'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$code = '[DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);'; Add-Type -MemberDefinition $code -Name Wallpaper -Namespace Win32; [Win32.Wallpaper]::SystemParametersInfo(20, 0, 'C:\Users\Admin\Pictures\wallpaper_new.jpg', 3)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3falwzkf\3falwzkf.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A0D.tmp" "c:\Users\Admin\AppData\Local\Temp\3falwzkf\CSC79D58AF9CAC40B99A34E12435DBFA7D.TMP"
        5⤵
        
        PID:472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d835a32e38e0dfee8f8d93d9837e02eb505417d8456b0dbe5cd4da204dd9d4c7
MD5 f6dfcca5dce314499b7dbeaca751fbac
SHA1 08e40b364c5975aeddb20b457edf5c913ac79189
SHA512 e86e231a28e148e20df070f5b402cf6cc3db4d5e35d7557a32a427a2d6b91b507cedd08fccd133675b7a3c211e2aaf41156f58bd53ca3d7dd4a9a7432bca154a
TLSH
T1BC115733B3CC8724DC9A403650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

3falwzkf.dll

Path C:\Users\Admin\AppData\Local\Temp\3falwzkf\3falwzkf.dll
Size 3KB
SHA256 2c160d6b7ee074d413f343a74d7bb5bfcee01307708ce703f8eee3996a2686a9
MD5 5a7a32ff99a914fa13e38b75c99f1b72
SHA1 c8f7b586437eaf64fddfb97cefddb67c5cd4222f
SHA512 3485b6b7508f5ac161e74276a9e7fd46b0137ab31f9c5b48f49d9d0860be19fbd237728dacfb04039ba9018b7c6813211a4ca4cd139549eb3f6de315deb870ef
TLSH
T17E51DE1AA3E8466BE47707306DF3876637B4F824AFB3935D48C00368AC607645A72BB0
MD5 SHA1 SHA512 TLSH

Submit Download

5B67.bat

Path C:\Users\Admin\AppData\Local\Temp\5B55.tmp\5B66.tmp\5B67.bat
Size 750B
SHA256 27de25693b38984a6d670dfbd12baa7044feb19da7b1ba269fe633194945fe81
MD5 8eb90c6406c8e54a2946160ca9c4b51f
SHA1 ba7574e93cb311cb70cf0944d727b2047cd9e73e
SHA512 942ef8ad0b9386531593be15987dfa9fe4dbc828f34b191403f36f501c6a8a2d9212e52305bb52c1af4996ba9e94643af2c2de6eddd4999a047e233ee8a55c9e
TLSH
T1F501B523300141794A22C568D8936023FEBA62DBB55A31CB30F0F1116E4FE1AD6F2A4D
MD5 SHA1 SHA512 TLSH

Submit Download

RES3A0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3A0D.tmp
Size 1KB
SHA256 4580dea72e019adf58b9d8cc78a55620fd9b7bc9cd73c66ddfabe7ef7d2a1605
MD5 52b9fe16e65908a973cee5f753fd629c
SHA1 7b3b65ee06cddba6b5eba67043084e573bae1c04
SHA512 50ea1a627e58f63b69e57b049fd514e8798d0ece01419835353189853d277439d4f8a948c7384f4a175de5495f6c21f029c3868a542663b14e145b32d03803f1
TLSH
T141218C05A3E9471EF0734731ADF6172FA274FD64AE72575A894042682C51544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

3falwzkf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3falwzkf\3falwzkf.0.cs
Size 274B
SHA256 21504fd073038a8709b2bcbf3556708c7c2b9dda80dba5af80158866fc22f6bf
MD5 1fd21394b33e86f5137153f93fafb2c8
SHA1 ffafab07693283f79c4cc3f5ca0d4fda5f93bbea
SHA512 6d80b1f74188a6165b4a7510abd8ae730b32c33e5d33108b766a9a5ade159cb3d81bfdd992f66ac090642430dbd4afc6350c6432cb3a2eba4e797c447c1b0489
TLSH
T17CD02B24B693DAF88443081B4C83A0B57737916B72DB7A0579F86110CF8B4182932A29
MD5 SHA1 SHA512 TLSH

Submit Download

3falwzkf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3falwzkf\3falwzkf.cmdline
Size 369B
SHA256 a0872f3a179b7a2b4aea0e7737509b16ae656df7d799c811e0f7ed0763b4080c
MD5 9d453afdce0432fe13f04c5d075289cd
SHA1 728131e5e155316d6070b1dbd4e5f6fd2b1e7d35
SHA512 3efe8054c909cf6d4416116b623cd8c0ea78f0bb504b03e61661bc1602a15d2b95a00d02afebbf476df9376a80f849458ba1a3d9da05156b0c4932f3e7b70d10
TLSH
T17EE0686A4266C67E12EB100F22FBE4ACC3B31A4F39403F84584844CEE21700027E3752
MD5 SHA1 SHA512 TLSH

Submit Download

CSC79D58AF9CAC40B99A34E12435DBFA7D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3falwzkf\CSC79D58AF9CAC40B99A34E12435DBFA7D.TMP
Size 652B
SHA256 9ddd0ba4c5742db071c0d88782814416518143fc9cd58d0aefe6251cfad1335a
MD5 a03db4413e1ff29ba1441df7df1d5243
SHA1 a24ce2850736732c2d00780dbd24780c0c39fdf8
SHA512 3759d4e1f4f49682a4f23bbd8b4a930df93a707a327b86809774c09670b309372fbe9e5b13b3940f149347a0738468e561dbd2db77acde74e25e4dfa607fa650
TLSH
T1A0F0540963F8120EF0F34B30BDF543A3A1A8BC65DE3253ED5440031958645108661F71
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-8-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-11-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-13-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-14-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-16-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-17-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-20-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-12-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-10-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-9-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-6-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-7-0x00000164C0F40000-0x00000164C0F62000-memory.dmp

Download

memory/2324-3-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2324-2-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/5544-37-0x00000230C0990000-0x00000230C0998000-memory.dmp

Download