84f84420c4c6a326a2132fba5ba6d8f2807119bdb40a652f8379c7857ba54f23

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 224KB
Sample261001-qccfesca68
SHA256 84f84420c4c6a326a2132fba5ba6d8f2807119bdb40a652f8379c7857ba54f23
MD5 1448516a2dd4ca42e39fc277ba0ebc18
SHA1 584dd4a9d2f9b03fa182907d19c53510af336848
SHA512 5f4387518f22540777b5ca67dd3842dc27176a3b71738af6c35852c3498ef9b2e73bc271f89d59a61642e2f7212b38e8e514812f7cc153be80690decc3ec34c9
SSDEEP 6144:q98A/ehUOqxaPBibVNXyO+agWeyUCPbDddBSCpMW90KImQiXnhblew:qWAwUOqxaPYb7i5agWegvj
TLSH
T19F24395813AB893DDA3D237ED0A112050BF56227C103E35D9EE5E4F85F2B712AB12B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	cmd.exe
\??\F:\	attrib.exe
\??\F:\	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2564	cmd.exe
4792	cmd.exe
3032	cmd.exe
5056	cmd.exe
1676	cmd.exe
5680	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinLock.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinLock.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2864	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	WinLock.exe
4820	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	WinLock.exe
Token: SeDebugPrivilege	2864	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5680	4820	WinLock.exe	94
PID 4820 wrote to memory of 1676	4820	WinLock.exe	95
PID 4820 wrote to memory of 5056	4820	WinLock.exe	96
PID 4820 wrote to memory of 3032	4820	WinLock.exe	97
PID 4820 wrote to memory of 4792	4820	WinLock.exe	98
PID 4820 wrote to memory of 2564	4820	WinLock.exe	99
PID 4820 wrote to memory of 2864	4820	WinLock.exe	100
PID 5680 wrote to memory of 4300	5680	cmd.exe	116
PID 1676 wrote to memory of 5636	1676	cmd.exe	117
PID 3032 wrote to memory of 4424	3032	cmd.exe	118
PID 2564 wrote to memory of 2416	2564	cmd.exe	119
PID 4792 wrote to memory of 572	4792	cmd.exe	120
PID 5056 wrote to memory of 3952	5056	cmd.exe	121
PID 5680 wrote to memory of 5416	5680	cmd.exe	122
PID 2564 wrote to memory of 1580	2564	cmd.exe	123
PID 3032 wrote to memory of 2368	3032	cmd.exe	124
PID 1676 wrote to memory of 4936	1676	cmd.exe	125
PID 5056 wrote to memory of 4292	5056	cmd.exe	126
PID 4792 wrote to memory of 1244	4792	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
572	attrib.exe
3952	attrib.exe
1580	attrib.exe
2368	attrib.exe
4936	attrib.exe
4292	attrib.exe
4300	attrib.exe
5636	attrib.exe
4424	attrib.exe
2416	attrib.exe
5416	attrib.exe
1244	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Enumerates connected drives
    - Views/modifies file attributes
    PID:4300
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Enumerates connected drives
    - Views/modifies file attributes
    PID:5416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5636
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3952
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4424
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:572
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2416
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1580
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 82B
SHA256 9b1fac1dbd517ff0452740132882efd6fa11a9bfa1b616f78b6c857506973623
MD5 93cbc33c5c1e53ef9f802fcaae2debcc
SHA1 6d85496bb9f256cb53243e33f3ced5c75e3fc144
SHA512 a12abc02987c07feef2a67e19ee511a3eda688702a4ae94e5c2a5659f35446edae92aa2d92b23e58246d525dcb2c8d9002dc950bf9dab68b562d246ecbcb6332
TLSH
T16CA012112D1C3258101211F23532A001247DD81C10172442410040D60070181D4EB614
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 82B
SHA256 b6242ca2ef69ec1b15d02abe6b5b860c7f68e4676f480b74c11cd3775ad16650
MD5 565d5a163d758896f83c476805079ba1
SHA1 a47402a405ca765031eca591f0f3918acfc0b0b0
SHA512 1ca871771ab0602ed4b2755b119aa9d95977fdce9f3a22dbe1f4594d5f11cafd0d63f1fdf5cb66c4bd002ed96e373303cb29387a13d9aa79c6ba61c57765e3f8
TLSH
T1AAA012112D187288201511F236326001287DD81C10133442420041E60010080D4EB910
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4584-8-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4584-7-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4584-9-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4584-10-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-6-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-3-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-0-0x00007FF866A6F000-0x00007FF866A70000-memory.dmp

Download

memory/4820-5-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-4-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-2-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-1-0x0000000000CD0000-0x0000000000D0E000-memory.dmp

Download

memory/4820-26-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-27-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download

memory/4820-28-0x00007FF8668E0000-0x00007FF867284000-memory.dmp

Download