a99a747b7e0458b4cbcaa94d9b063edd17f112ca21e947439bf2dbab95d61791

Analysis

user interaction
yes
max time kernel
25s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 741KB
Sample260825-pmtl1ssbrd
SHA256 a99a747b7e0458b4cbcaa94d9b063edd17f112ca21e947439bf2dbab95d61791
MD5 35261fe47916dedc5ddcc6e75408250b
SHA1 a36acd9720240b5e89c48fb4cbcb70ee40026857
SHA512 29ff1050eaa01135f15faff7f2c157555d2911e2e0cfb3e01e7e7074b1c937b2f1be0bd892e0eefecad0daaf39790b3607fbd8040fc85966dcd216db1c267d3f
SSDEEP 12288:egAwUOqxaPNJWyD7j5Xx8ExlgZ6MmUs3jXcyigWZKbSw5HvOSG1Uhfvj:rJJjD7DtxIPs3jNB2w5PqUN
TLSH
T1B2F4DF5C0A564B28D52C777AF055438406F45232A483D70BCEB4A4B0BA27787EAE5FFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3740	cmd.exe
4700	cmd.exe
6136	cmd.exe
624	cmd.exe
1776	cmd.exe
4392	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4732	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4004	WinLock.exe
4004	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	WinLock.exe
Token: SeDebugPrivilege	4732	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3740	4004	WinLock.exe	90
PID 4004 wrote to memory of 4700	4004	WinLock.exe	91
PID 4004 wrote to memory of 6136	4004	WinLock.exe	92
PID 4004 wrote to memory of 624	4004	WinLock.exe	93
PID 4004 wrote to memory of 1776	4004	WinLock.exe	94
PID 4004 wrote to memory of 4392	4004	WinLock.exe	95
PID 4004 wrote to memory of 4732	4004	WinLock.exe	96
PID 1776 wrote to memory of 2608	1776	cmd.exe	114
PID 624 wrote to memory of 2096	624	cmd.exe	115
PID 4700 wrote to memory of 5780	4700	cmd.exe	116
PID 3740 wrote to memory of 5676	3740	cmd.exe	117
PID 6136 wrote to memory of 2016	6136	cmd.exe	118
PID 3740 wrote to memory of 4544	3740	cmd.exe	119
PID 624 wrote to memory of 464	624	cmd.exe	120
PID 4700 wrote to memory of 2840	4700	cmd.exe	121
PID 6136 wrote to memory of 2672	6136	cmd.exe	122
PID 1776 wrote to memory of 3712	1776	cmd.exe	123
PID 4392 wrote to memory of 3092	4392	cmd.exe	124
PID 4392 wrote to memory of 4340	4392	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2016	attrib.exe
464	attrib.exe
2840	attrib.exe
2672	attrib.exe
3712	attrib.exe
2608	attrib.exe
5676	attrib.exe
4544	attrib.exe
3092	attrib.exe
4340	attrib.exe
5780	attrib.exe
2096	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5676
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5780
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2016
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2096
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2608
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @bz 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3092
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4340
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4732

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\info-Locker.txt
Size 70B
SHA256 6a6fb3ed717fd112f6c802c445a332bbf60d8f1b4b4e1850e0df37f5f2d34612
MD5 b043f4c6c30453e0148ffbcbe2e3a84b
SHA1 ff54069011930caa197910a664685cc257d4af07
SHA512 546e721e0e7599d5abc1257d82418fbca5929637da937d1262e98ca68a58b4cd685ab70ed2156970bb3a2b0f34990717447b9e568c9a90d957dabbe2bbadb3eb
TLSH
T11BA022003E2C22C8302022F33832B000A8BCEC0C20033C82820000B320A00C02CEF820
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 70B
SHA256 e7e98a7dfa16dc45d9b6f18d9910a03e254d3b10e7a7548d950fcc4387a99183
MD5 3432740b87600b672a1b721caede0c96
SHA1 bf4aa0beb9bc4e1c43477bfc95b4fede0b8d83f1
SHA512 a810c7ba4d2989cf67d6a9e912fd4a93413a44cb3721b2b2ef03fcc0c5278431a85a88c2ed609afa66979738acff027d1d6e9376ddfc799544a174772010740e
TLSH
T1A1A022003E2C22C8308022F33833B00028BEEC0C20033C82830000A3A0200C02CEF820
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 70B
SHA256 a4d04bec320f75995903e69940180cc36961fa8a9ce0902713ef70e5a34df417
MD5 5c033f547508d67c8bbc52e5751074ff
SHA1 fbd92625781667e289b58d09f7123865edc41dfa
SHA512 f7db7451ec5895acb977b2620e1bc936fd4b126e67ff058ee99cbda5059a1cc9ab06f823b2ad775708d77d595daaa635458f4b209add1f14fb9c754a7ef58064
TLSH
T11CA022003E2C22C8302022F33832B000A8BCEC2E20033C82A30000A320300C02CEF822
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4004-13-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-2-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-5-0x000000001E870000-0x000000001E972000-memory.dmp

Download

memory/4004-6-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-7-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-9-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-12-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-0-0x00007FF9AFEDF000-0x00007FF9AFEE0000-memory.dmp

Download

memory/4004-3-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-4-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-25-0x000000001D1A0000-0x000000001D1E2000-memory.dmp

Download

memory/4004-1-0x00000000003F0000-0x00000000004B0000-memory.dmp

Download

memory/4004-27-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-28-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-29-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-30-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-31-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download

memory/4004-32-0x00007FF9AFD50000-0x00007FF9B06F4000-memory.dmp

Download