Analysis
- max time kernel
900s - max time network
479s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinLocker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
WinLocker.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
General
- Target WinLocker.exe
- Size 3.0MB
- Sample261017-rx2fqagv6n
- SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
- MD5 ce3678888a5212a6a508a9d025b0681e
- SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
- SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
- SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
- TLSH T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes a file named after a Windows system binary 1 TTPs 1 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
description ioc Process File opened (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe svchost.exe - Executes dropped EXE 1 IoCs
pid Process 932 svchost.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemLock = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe" WinLocker.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe 2444 WinLocker.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2444 WinLocker.exe 2444 WinLocker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4800
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
- Size 3.0MB
- SHA256 4ef5d27b5f41341698d3a27e4cca6526dafcafa300cf5ac4dc050227ae69f5fb
- MD5 ce3678888a5212a6a508a9d025b0681e
- SHA1 e55ab28b42148b91a81da3b6484cae01d25a2df8
- SHA512 75d870da969827d2ac21b43f1abdf42e3e20320dce58952204cd2f38d7afa28d66a646d7dccba2a648d3c3c68a31092427cc79f1db7411a06573104fb17d5da3
- SSDEEP 49152:+/6ASCp9av0vf4dr4sKIxDJJzRncR1Q+Bj3KevGEEre:Oav0vf4dBDjzRncR1Vt3KevGEEre
- TLSH T18BE5194369DB0CE5CED26BB465D71335A734FD72CA291F3BAA08C2316D636C4AD1AB10
- MD5 SHA1 SHA512 SSDEEP TLSH