General
- Target winlocker.exe
- Size 183KB
- Sample260909-xjtrls11fv
- SHA256 fa572f6e384463bc4b53b416d1d52cecb8b2ea905fa55bc081e2e3192bf0e3f5
- MD5 1c179cfd28c1786efb72985b356a5e35
- SHA1 59855f5fa3693140d83895055e11231302c20329
- SHA512 e08fc7f259a65b4dd1a82a1fbe35b7b3cd2f6eb8cf53263a6f70ce5fed76f7f3713f86e721313a0ae673fb63abe0b7468fd040b93576342b4e10dbf5d122d202
- SSDEEP 3072:gn4pzFUOcaiYihrnZqh2nkoU3BKuP/eRqbk6BHD7gD:g4pJUOcD8h2nkoUR0RqbP
- TLSH T197044B053BB9AD36CDAC123AB0A6660543FAE512D263EB847C8D98FD5ED3701D706B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
winlocker.exe
Resource
win10v2004-20260513-en
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
winlocker.exe
Resource
win11ltsc2024-20260709-en
8 signatures
900 seconds
Malware Config
Targets
-
- Target winlocker.exe
- Size 183KB
- SHA256 fa572f6e384463bc4b53b416d1d52cecb8b2ea905fa55bc081e2e3192bf0e3f5
- MD5 1c179cfd28c1786efb72985b356a5e35
- SHA1 59855f5fa3693140d83895055e11231302c20329
- SHA512 e08fc7f259a65b4dd1a82a1fbe35b7b3cd2f6eb8cf53263a6f70ce5fed76f7f3713f86e721313a0ae673fb63abe0b7468fd040b93576342b4e10dbf5d122d202
- SSDEEP 3072:gn4pzFUOcaiYihrnZqh2nkoU3BKuP/eRqbk6BHD7gD:g4pJUOcD8h2nkoUR0RqbP
- TLSH T197044B053BB9AD36CDAC123AB0A6660543FAE512D263EB847C8D98FD5ED3701D706B43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1