General
- Target WinLock.exe
- Size 209KB
- Sample260712-ncakqaav81
- SHA256 c964cff8e64942ab999bce7fd91b20956bdc9b97aa3df9b41c9458a533065837
- MD5 54e1daceec34362d84f0c54d35b39af8
- SHA1 8b762b35968bb397bab08b1a717ba1e0d46e1bd9
- SHA512 4bc31a5cc13520facd3768a5fdfc588b57e732fdcd6e0f2df8c0a8cb7400c66367e91929669ca3d1e1f70080b987bb313e7f04bcd4a458c4cbc5d82c9b3d366f
- SSDEEP 6144:rM8A/ehUOqx8PBmnRtQ0UuB97SCpMW90KImQijnCbxewO:rvAwUOqx8PMjQk
- TLSH T1952449981397897DD63D237ED0A1120907F56223C503F34E9EE5E4F89E2B3529B22B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinLock.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinLock.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target WinLock.exe
- Size 209KB
- SHA256 c964cff8e64942ab999bce7fd91b20956bdc9b97aa3df9b41c9458a533065837
- MD5 54e1daceec34362d84f0c54d35b39af8
- SHA1 8b762b35968bb397bab08b1a717ba1e0d46e1bd9
- SHA512 4bc31a5cc13520facd3768a5fdfc588b57e732fdcd6e0f2df8c0a8cb7400c66367e91929669ca3d1e1f70080b987bb313e7f04bcd4a458c4cbc5d82c9b3d366f
- SSDEEP 6144:rM8A/ehUOqx8PBmnRtQ0UuB97SCpMW90KImQijnCbxewO:rvAwUOqx8PMjQk
- TLSH T1952449981397897DD63D237ED0A1120907F56223C503F34E9EE5E4F89E2B3529B22B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1