3ab4d2a32de98724eeaa87358630b688b596b8d50914d2eb04925fa4615ebef8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 12:07

Target
winlocker.exe
Size 6.2MB
Sample260528-pal2eaev6r
SHA256 3ab4d2a32de98724eeaa87358630b688b596b8d50914d2eb04925fa4615ebef8
MD5 222a1a2918f0ec3e6fee5f1a9370c9f0
SHA1 defd24177335a9ad22a85a2c66624046df5220f5
SHA512 5afbd01fc128756e4ec0144344a1db72934afc88341322f9f06cd51332d917660babef4f4c0e77a7ffdba8789763399d0adde5bf4803bee51a759c4a4ce6a293
SSDEEP 49152:na+ExIaaa9V/l9D0mB8LMrRZnoIgSAFWwKagfE95Npc18NrAQhJC3g1w:naNnT50mB8uAr5NhE4CH
TLSH
T128662A27ECA229D4C4EE8175C673412BBA627C491B7423E715E1F3241F36BE09EB6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs

Image File Execution Options Injection

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "systray.exe"	winlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	winlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "systray.exe"	winlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	winlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "systray.exe"	winlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	winlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "systray.exe"	winlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	winlocker.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlocker.exe	winlocker.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4108	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4108	4964	winlocker.exe	79
PID 4964 wrote to memory of 2236	4964	winlocker.exe	81
PID 4964 wrote to memory of 4376	4964	winlocker.exe	83
PID 4964 wrote to memory of 5596	4964	winlocker.exe	85
PID 4964 wrote to memory of 3920	4964	winlocker.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\winlocker.exe
"C:\Users\Admin\AppData\Local\Temp\winlocker.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn TEK@QMQC@UAH /tr C:\Users\Admin\AppData\Local\Temp\winlocker.exe /sc onstart /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4108
- C:\Windows\system32\sc.exe
  sc create TEK@QMQC@ binPath= C:\Users\Admin\AppData\Local\Temp\winlocker.exe start= auto DisplayName= TEK@QMQC@ type= own
  2⤵
  - Launches sc.exe
  PID:2236
- C:\Windows\system32\sc.exe
  sc sdset TEK@QMQC@ D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)
  2⤵
  - Launches sc.exe
  PID:4376
- C:\Windows\system32\sc.exe
  sc start TEK@QMQC@
  2⤵
  - Launches sc.exe
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\winlocker.exe
  C:\Users\Admin\AppData\Local\Temp\winlocker.exe XXPQ@PVKAY 4964
  2⤵
  PID:3920