General
- Target WinLock.exe
- Size 209KB
- Sample260712-vts7qaes4k
- SHA256 bf8ee581cb1463ac181502d01ac9c641361b126bbe3c1a296cd0504d21aca0e6
- MD5 d11a4970e86f1aaf4eb53c5f06478e4f
- SHA1 64e3da90fb9561242b783e0d85eb322f57a96559
- SHA512 ea47d8aa4fc524f31e135ad6ac3df35d70ecd789dbe4b16c3f7e7b438ab968f803ad8d580be3574f6a95dd2f50d57736e58a6b0fa9893a627ec7030a93f7518f
- SSDEEP 6144:RM8A/ehUOqx8PB6nRtQ0UOB97SCpMW90KImQijnCbFewO:RvAwUOqx8PsjQE
- TLSH T1B92449981397897DD67D237ED0A1120907F56223C503F34E9EE5E4F89E2B3129B22B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinLock.exe
Resource
win11-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target WinLock.exe
- Size 209KB
- SHA256 bf8ee581cb1463ac181502d01ac9c641361b126bbe3c1a296cd0504d21aca0e6
- MD5 d11a4970e86f1aaf4eb53c5f06478e4f
- SHA1 64e3da90fb9561242b783e0d85eb322f57a96559
- SHA512 ea47d8aa4fc524f31e135ad6ac3df35d70ecd789dbe4b16c3f7e7b438ab968f803ad8d580be3574f6a95dd2f50d57736e58a6b0fa9893a627ec7030a93f7518f
- SSDEEP 6144:RM8A/ehUOqx8PB6nRtQ0UOB97SCpMW90KImQijnCbFewO:RvAwUOqx8PsjQE
- TLSH T1B92449981397897DD67D237ED0A1120907F56223C503F34E9EE5E4F89E2B3129B22B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1