Analysis
- user interaction
yes - max time kernel
132s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 02:53
Behavioral task
behavioral1
Sample
set_wallpaper_lock.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
set_wallpaper_lock.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target set_wallpaper_lock.exe
- Size 69.5MB
- Sample260822-ddgqbaea76
- SHA256 61becbc8ee6a010d6f582a11bd8236ea950e5fec29ca5c50b8a74573b3c99ff1
- MD5 1fcadf38b0dd09aad14f86b229275dfd
- SHA1 15e9e6d9b34f495cdb987d0e3ec4e727d64c0c61
- SHA512 4e96b26940a937ecf1dbf1e9841627492255e2d391621489184e6406e2b52e8ecdfd15e56e52f5a02ee2d07d226311716b5459592edd39ca2eab7ce361a2b719
- SSDEEP 1572864:8Yxh2WlD+dy2J0f0/rBdsG7bpip0WWPnGCnk7aV+BbnYzTNJp1:8YxQUI5BB7tE0WoGCnkWV+BbYXN
- TLSH T1A3F73344AC5616DBF70A8736CCF2A8671BEF75198766C05A13D98903AB3B2C5EC7C423
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5244 set_wallpaper_lock.exe 5244 set_wallpaper_lock.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3832 wrote to memory of 5244 3832 set_wallpaper_lock.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\set_wallpaper_lock.exe"C:\Users\Admin\AppData\Local\Temp\set_wallpaper_lock.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\set_wallpaper_lock.exe"C:\Users\Admin\AppData\Local\Temp\set_wallpaper_lock.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5244
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\_bz2.pyd
- Size 84KB
- SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
- MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
- SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
- SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
- SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
- TLSH T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\_ctypes.pyd
- Size 131KB
- SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
- MD5 744a8886e7187cb632da61e2d48ebafa
- SHA1 e105fe498617813f2d34e578d48b82e23e56a972
- SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
- SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
- TLSH T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\_lzma.pyd
- Size 155KB
- SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
- MD5 a6bd469ef44eb08284a417fd5aaa4096
- SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
- SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
- SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
- TLSH T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\_socket.pyd
- Size 84KB
- SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
- MD5 a40238c4b5c9821defaef7cbf70574c3
- SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
- SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
- SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
- TLSH T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\base_library.zip
- Size 1.3MB
- SHA256 31f7279ea13525686871605c607adb99a948e950c099b7ab9d5f2f8699321440
- MD5 59c123c0ccb1f3eb780e97c0be737bcf
- SHA1 b6e0bcfe8ceca176766fcc27a5393a42118c2ef6
- SHA512 f6b3618d43ff4cd29d579d53a7a15d0372d99fef99cb70d1ed07cc708766c48cda7229fd89b94d76e43c66101302a7cab62d6a18e2fa7915509a4959ffed9870
- SSDEEP 12288:qLW7WpiHwsEwi2cPPdxhYPL+DvdjdTTnuIva80201jwCVRDVoioSY1miXg7BFWC9:n7Wpmw05cPPdxhYgdZTnLSuTxmwpqrV
- TLSH T120651982B9527553FF64F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\python3.DLL
- Size 70KB
- SHA256 16f109e8411bc08341497c87704b7cf0d22a2678f1e3a7dca416ea7bff995469
- MD5 c460c13c3fa9038cf9c5e379b6d91281
- SHA1 500df0f6ff1641983bf1abafd2829ce3c06912ff
- SHA512 08eba88a8c9457568d201f6a64592ebeb037f33efe4cc081672a707a62fdc7cc5924520528386461c36a4ec5fdf16999ee0b99bc82f7ec6c2eabc0973f1289dc
- SSDEEP 768:x+QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxE:kotssyKcunV8PSlIFy0Ay1Ni9ifIkZE
- TLSH T113633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\python313.dll
- Size 5.8MB
- SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
- MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
- SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
- SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
- SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
- TLSH T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000ef82\select.pyd
- Size 32KB
- SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
- MD5 9583139460ba3a40961b03c76f12450f
- SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
- SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
- SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
- TLSH T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
- MD5 SHA1 SHA512 SSDEEP TLSH