General
- Target WinLock.exe
- Size 218KB
- Sample261015-1cdzcsswgt
- SHA256 ad6e9f56269b4d14dd317cc717744c971291cdb1be42b5010388b0afb8524507
- MD5 a7c47f7dc743ce465e52ac9f2ac10def
- SHA1 fa0af2ec7e89474c6cfc58283419283f405528ff
- SHA512 d25a3b9919e07861f9be40f3204b4a4dc51801b20d5952c941e5f0758c49089d63c1af53872d2d52feba924e08b1f6a1e7f9e9aab18b7e03883208d3471a0b32
- SSDEEP 6144:ZVPq48pTFfgUnRtjUZmK0SCpM69/KImQiznmbna:SrpZjG
- TLSH T10924181813B6C679D6BE77BEE192120513F4A143D313F74DCAE860E82E633139E599A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinLock.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinLock.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target WinLock.exe
- Size 218KB
- SHA256 ad6e9f56269b4d14dd317cc717744c971291cdb1be42b5010388b0afb8524507
- MD5 a7c47f7dc743ce465e52ac9f2ac10def
- SHA1 fa0af2ec7e89474c6cfc58283419283f405528ff
- SHA512 d25a3b9919e07861f9be40f3204b4a4dc51801b20d5952c941e5f0758c49089d63c1af53872d2d52feba924e08b1f6a1e7f9e9aab18b7e03883208d3471a0b32
- SSDEEP 6144:ZVPq48pTFfgUnRtjUZmK0SCpM69/KImQiznmbna:SrpZjG
- TLSH T10924181813B6C679D6BE77BEE192120513F4A143D313F74DCAE860E82E633139E599A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1