File name:

WinLocker.exe

Full analysis: https://app.any.run/tasks/60baa3c5-97a0-423a-a824-c5082ebe410e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 18, 2025, 11:42:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
winlocker
loader
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

79E7DE9876E14D9FD5B4A94749089A77

SHA1:

977548CAC5E10DBEE041A44D0F7A1E7E0CF8ED01

SHA256:

9E2210450373A258E24EED14EBBB730F1722D9FD6F3B1A187D9DE9252B8BFE25

SSDEEP:

98304:BcCyub1kqAzajfr/qSRmkgTv908yj2fBRhdLfCdat6zcMlU3UJfdA48X6GM+1:Shz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • WINLOCKER mutex has been found

      • WinLocker.exe (PID: 7432)

    • Disables the LogOff the Start menu

      • WinLocker.exe (PID: 7432)

    • Disables the Find the Start menu

      • WinLocker.exe (PID: 7432)

    • Changes image file execution options

      • WinLocker.exe (PID: 7432)

    • UAC/LUA settings modification

      • WinLocker.exe (PID: 7432)

    • Disables the Run the Start menu

      • WinLocker.exe (PID: 7432)

    • Changes the autorun value in the registry

      • WinLocker.exe (PID: 7432)

    • Disables the Shutdown in the Start menu

      • WinLocker.exe (PID: 7432)

    • WINLOCKER has been detected (YARA)

      • WinLocker.exe (PID: 7432)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • WinLocker.exe (PID: 7432)

    • There is functionality for taking screenshot (YARA)

      • WinLocker.exe (PID: 7432)

    • Reads security settings of Internet Explorer

      • WinLocker.exe (PID: 7432)

    • Starts CMD.EXE for commands execution

      • WinLocker.exe (PID: 7432)

  • INFO

    • Checks supported languages

      • WinLocker.exe (PID: 7432)
      • SearchApp.exe (PID: 8024)

    • Reads the computer name

      • WinLocker.exe (PID: 7432)
      • SearchApp.exe (PID: 8024)

    • Create files in a temporary directory

      • WinLocker.exe (PID: 7432)

    • Compiled with Borland Delphi (YARA)

      • WinLocker.exe (PID: 7432)
      • SearchApp.exe (PID: 8024)

    • Process checks computer location settings

      • SearchApp.exe (PID: 8024)
      • WinLocker.exe (PID: 7432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (94.6)
.exe | Win32 Executable Delphi generic (2)
.scr | Windows screen saver (1.8)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 1146368
InitializedDataSize: 1500160
UninitializedDataSize: -
EntryPoint: 0x118d94
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #WINLOCKER winlocker.exe sppextcomobj.exe no specs slui.exe no specs searchapp.exe no specs cmd.exe no specs conhost.exe no specs winlocker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4212"C:\Windows\System32\cmd.exe" /c TASKKILL /F /FI "Imagename ne WinLocker.exe" /FI "USERNAME eq %USERNAME%C:\Windows\SysWOW64\cmd.exe—WinLocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
7276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7336"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7432"C:\Users\admin\AppData\Local\Temp\WinLocker.exe" C:\Users\admin\AppData\Local\Temp\WinLocker.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\winlocker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7556C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7596"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8024"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 101
Read events
1 065
Write events
36
Delete events
0

Modification events

(PID) Process:(7432) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:DisableCMD
Value:
2
(PID) Process:(7432) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(7432) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Java
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(7432) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(7432) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Operation:writeName:Debugger
Value:
C:\Users\admin\AppData\Local\Temp\WinLocker.exe
(PID) Process:(7432) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall
Operation:writeName:NoAddRemovePrograms
Value:
1
(PID) Process:(7432) WinLocker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:HideFastUserSwitching
Value:
1
(PID) Process:(7432) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced
Operation:writeName:NoClose
Value:
1
(PID) Process:(7432) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableLockWorkstation
Value:
1
(PID) Process:(7432) WinLocker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableChangePassword
Value:
1
Executable files
0
Suspicious files
4
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7432WinLocker.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
7432WinLocker.exeC:\MBR.binbinary
MD5:0DA182957D5B2BD11A50DA7293ACEB77
SHA256:4EAE113930004A304FCAB258B075265F9E934A46D9CA09665258ACCDA77F87D2
7432WinLocker.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.001.etlbinary
MD5:CE9A3EB72FB377BFC576899068D9EDAC
SHA256:636E507137273DC6A71BF98999554E5B6234CCDDF504495FE69F4B718FBC43F3
7432WinLocker.exeC:\Users\admin\AppData\Local\Temp\Time2.initext
MD5:97ABE1980F4EA3804340CCA16CD914EC
SHA256:DCBF287018F6ACDF68B133E4DBC9A910F8078C7A425FE6CDA2322307FE86E305
7432WinLocker.exeC:\Windows\appcompat\Programs\Amcache.hve.LOG1binary
MD5:5425D35B581ACE35108E538D35AEF245
SHA256:52CE843B016FD1CAC6DACA3340424BA0A66F82A387C56B4DD956438C3EAF9074
7432WinLocker.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:65656CA9732A430DFC76548720F851EB
SHA256:4D148F562B298980AFF66754023C363BC9A283CB6E19F89BECCA9ED3ABFC6C22
7432WinLocker.exeC:\Users\Public\monkeiii.dlltext
MD5:E61E1A0E20D8E31E2F83394F642666B0
SHA256:87A67F79ADAE5A9E6C57867C3F9539329975020B3E54CF38C4F76DD19DA65ECF
7432WinLocker.exeC:\Users\admin\AppData\Local\Temp\Time.initext
MD5:EB13B7EAF7F30D348E471F0907B31AAC
SHA256:94BA214735774FB4E68BE906C3E181D29C71DBBCD10540E70BA7021FCF5EA3AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.68
  • 40.126.31.129
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.131
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
WinLocker.exe