77148d726c9935ba7adf4dc3ddb449a23ca0ed82ee1783f2aedc0e4115cd0dc0

Analysis

max time kernel
600s
max time network
423s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 295KB
Sample261102-p2f98sh17w
SHA256 77148d726c9935ba7adf4dc3ddb449a23ca0ed82ee1783f2aedc0e4115cd0dc0
MD5 342827360e2c90325e0cb72b6a6e44c5
SHA1 25d79519ba84345cad9a44c6cbff136989b509a2
SHA512 c63d8256691fb31ad1b8735e1e0e8b2577249cd31379ddc3a4f0ee296e7146462ea14c403601428290c2a632ff24494927b88ebfe43d3fa43f515fb669fff4e9
SSDEEP 6144:H68A/ehUOqx8PBUUstYEEXp8cnoZC6Bf+0lQ8vmaZ1+9XSCpMW90KImQijnCbJeB:HRAwUOqx8P2GNnoMcfzvmwo
TLSH
T170548C58139B897DD63D337ED0A112040BF56227C507E34E9EE5E4F85E2B3129B22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4604	cmd.exe
1892	cmd.exe
4692	cmd.exe
5860	cmd.exe
1824	cmd.exe
1296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinLock.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinLock.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2376	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	WinLock.exe
4292	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	WinLock.exe
Token: SeDebugPrivilege	2376	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4692	4292	WinLock.exe	93
PID 4292 wrote to memory of 1892	4292	WinLock.exe	94
PID 4292 wrote to memory of 4604	4292	WinLock.exe	95
PID 4292 wrote to memory of 1296	4292	WinLock.exe	96
PID 4292 wrote to memory of 1824	4292	WinLock.exe	97
PID 4292 wrote to memory of 5860	4292	WinLock.exe	99
PID 4292 wrote to memory of 2376	4292	WinLock.exe	100
PID 1892 wrote to memory of 2336	1892	cmd.exe	116
PID 1296 wrote to memory of 5488	1296	cmd.exe	117
PID 5860 wrote to memory of 1604	5860	cmd.exe	118
PID 4604 wrote to memory of 4264	4604	cmd.exe	119
PID 4692 wrote to memory of 5972	4692	cmd.exe	120
PID 1824 wrote to memory of 3908	1824	cmd.exe	121
PID 5860 wrote to memory of 4288	5860	cmd.exe	122
PID 1892 wrote to memory of 3252	1892	cmd.exe	123
PID 1824 wrote to memory of 3304	1824	cmd.exe	124
PID 1296 wrote to memory of 3120	1296	cmd.exe	125
PID 4604 wrote to memory of 3804	4604	cmd.exe	126
PID 4692 wrote to memory of 1768	4692	cmd.exe	127

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1604	attrib.exe
3908	attrib.exe
5488	attrib.exe
2336	attrib.exe
3120	attrib.exe
1768	attrib.exe
3252	attrib.exe
5972	attrib.exe
4264	attrib.exe
4288	attrib.exe
3804	attrib.exe
3304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5972
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2336
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4264
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5488
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3908
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @hgfdsd 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1604
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4288
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:1472

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 73B
SHA256 7c78e5656332c06a4489dc4c4aaf5d28d3747e199e9e7d2b75b7c4115e3569ed
MD5 d6c901fe8bfedb6c63ec75873559933b
SHA1 1be70d7e796c60daec2079c29ab87f69d629ee2a
SHA512 66c20ba03f9f9e9e116c34fbd50c7c10fac4fe6ab138fe953d2dbd7b8ae32cf09128568a78a70e43581c805d755a181aa364b2b8a72383b28ae363aa1b414461
TLSH
T14CA022803F2C32C8208022F33832B20028BEE80E20233F822A0300A300308C038EF820
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4292-9-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-24-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-3-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-4-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-5-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-6-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-2-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-7-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-1-0x0000000000900000-0x0000000000950000-memory.dmp

Download

memory/4292-0-0x00007FFBB912F000-0x00007FFBB9130000-memory.dmp

Download

memory/4292-25-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-26-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-27-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-28-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-29-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download

memory/4292-30-0x00007FFBB8FA0000-0x00007FFBB9944000-memory.dmp

Download