General
- Target WinLock.exe
- Size 208KB
- Sample260810-w7garazzfx
- SHA256 204d5322b20d14bca4edb42e825a014cbfd0fde1b7321753d115222ab7b53bce
- MD5 ae41677fd895c5bb6d83a4e85c264c80
- SHA1 471ede401e9ad6c77e5b75e380edfae4cb01d90c
- SHA512 e349c214c8b796fa2488f8fc71f050a210884de1ada8fb5fca55679097f5db1425e8b2df4d19efb87123b4e5b47d570913f0c98740ef08a4144f8ad15f90dc9f
- SSDEEP 6144:8t8A/ehUOqxaPBC7nRtpUSPbDddWSCpMW90KImQiXnhbLew:8mAwUOqxaPA7jrvj
- TLSH T183244A9813AB897DD63D233ED0A1120507F46227C503E35E9EE5E4F95F2B312AB12B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinLock.exe
Resource
win10v2004-20260513-uk
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
WinLock.exe
Resource
win11ltsc2024-20260709-uk
8 signatures
900 seconds
Malware Config
Targets
-
- Target WinLock.exe
- Size 208KB
- SHA256 204d5322b20d14bca4edb42e825a014cbfd0fde1b7321753d115222ab7b53bce
- MD5 ae41677fd895c5bb6d83a4e85c264c80
- SHA1 471ede401e9ad6c77e5b75e380edfae4cb01d90c
- SHA512 e349c214c8b796fa2488f8fc71f050a210884de1ada8fb5fca55679097f5db1425e8b2df4d19efb87123b4e5b47d570913f0c98740ef08a4144f8ad15f90dc9f
- SSDEEP 6144:8t8A/ehUOqxaPBC7nRtpUSPbDddWSCpMW90KImQiXnhbLew:8mAwUOqxaPA7jrvj
- TLSH T183244A9813AB897DD63D233ED0A1120507F46227C503E35E9EE5E4F95F2B312AB12B97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Modifies WinLogon for persistence
Adds Run key to start application
Drops desktop.ini file(s)
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1