analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

winlock.zip

Full analysis: https://app.any.run/tasks/867d3bf9-cf8c-4508-8013-459aee3547bf
Verdict: Malicious activity
Analysis date: May 21, 2022, 09:33:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

F1643CC4AAC7DD15CFF9E5A87CD9E94D

SHA1:

900E3FCFF5EC7B31243C3521ECAFC12262EB9339

SHA256:

DCC88485E6CB3380EE0E5768498FAE0D45338A3E06CAA1F8CF09E7C7B97458FE

SSDEEP:

196608:vO0d1w14Oq24+LBfa+543b76JmzwFtbVP3CFwAVjOra3GW0HBqJ9:20Xw15LhaeOOJLfB3CFJVSFkX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3788)
      • winlock.exe (PID: 3548)
      • winlock.tmp (PID: 1652)

    • Application was dropped or rewritten from another process

      • winlock.exe (PID: 3548)
      • winlock.exe (PID: 2488)
      • winlock.exe (PID: 2044)
      • uia.exe (PID: 3360)
      • uia.exe (PID: 1808)

    • Changes the autorun value in the registry

      • winlock.tmp (PID: 1652)

    • Adds new firewall rule via NETSH.EXE

      • winlock.tmp (PID: 1652)

    • Loads dropped or rewritten executable

      • winlock.exe (PID: 2488)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3788)
      • winlock.exe (PID: 3548)
      • winlock.tmp (PID: 1652)
      • uia.exe (PID: 1808)
      • winlock.exe (PID: 2488)
      • winlock.exe (PID: 2044)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3788)
      • winlock.exe (PID: 3548)
      • winlock.tmp (PID: 1652)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3788)
      • winlock.exe (PID: 3548)
      • winlock.tmp (PID: 1652)

    • Reads the computer name

      • WinRAR.exe (PID: 3788)
      • winlock.tmp (PID: 1652)
      • winlock.exe (PID: 2488)

    • Reads Windows owner or organization settings

      • winlock.tmp (PID: 1652)

    • Reads the Windows organization settings

      • winlock.tmp (PID: 1652)

    • Creates a directory in Program Files

      • winlock.tmp (PID: 1652)

    • Uses NETSH.EXE for network configuration

      • winlock.tmp (PID: 1652)

    • Reads Environment values

      • netsh.exe (PID: 2764)

  • INFO

    • Manual execution by user

      • winlock.exe (PID: 3548)
      • winlock.exe (PID: 2488)
      • winlock.exe (PID: 2044)

    • Application was dropped or rewritten from another process

      • winlock.tmp (PID: 1652)

    • Creates files in the program directory

      • winlock.tmp (PID: 1652)

    • Checks supported languages

      • netsh.exe (PID: 2764)

    • Creates a software uninstall entry

      • winlock.tmp (PID: 1652)

    • Reads the computer name

      • netsh.exe (PID: 2764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: ???冷? ??⠭????.txt
ZipUncompressedSize: 296
ZipCompressedSize: 194
ZipCRC: 0xb11f2031
ZipModifyDate: 2020:09:11 12:42:00
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe winlock.exe winlock.tmp netsh.exe no specs winlock.exe no specs uia.exe no specs uia.exe winlock.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3788"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\winlock.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3548"C:\Users\admin\Desktop\winlock.exe" C:\Users\admin\Desktop\winlock.exe
Explorer.EXE
User:
admin
Company:
Crystal Office Systems
Integrity Level:
HIGH
Description:
WinLock Installation
Exit code:
0
Version:
8.42
Modules
Images
c:\users\admin\desktop\winlock.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1652"C:\Users\admin\AppData\Local\Temp\is-UA4C5.tmp\winlock.tmp" /SL5="$5017A,11624009,57856,C:\Users\admin\Desktop\winlock.exe" C:\Users\admin\AppData\Local\Temp\is-UA4C5.tmp\winlock.tmp
winlock.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ua4c5.tmp\winlock.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2764"netsh.exe" advfirewall firewall add rule name="WinLock" dir=in program="C:\Program Files\WinLock\winlock.exe" action=allowC:\Windows\system32\netsh.exe—winlock.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\gdi32.dll
2488"C:\Program Files\WinLock\winlock.exe" C:\Program Files\WinLock\winlock.exe—Explorer.EXE
User:
admin
Company:
Crystal Office Systems
Integrity Level:
MEDIUM
Description:
WinLock
Exit code:
1073807364
Version:
8.4.2.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winlock\winlock.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3360"C:\Program Files\WinLock\uia.exe" C:\Program Files\WinLock\uia.exe—winlock.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\program files\winlock\uia.exe
c:\windows\system32\ntdll.dll
1808"C:\Program Files\WinLock\uia.exe" C:\Program Files\WinLock\uia.exe
winlock.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\winlock\uia.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
2044"C:\Program Files\WinLock\winlock.exe" C:\Program Files\WinLock\winlock.exe—Explorer.EXE
User:
admin
Company:
Crystal Office Systems
Integrity Level:
MEDIUM
Description:
WinLock
Exit code:
0
Version:
8.4.2.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winlock\winlock.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 892
Read events
2 711
Write events
174
Delete events
7

Modification events

(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3788) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\winlock.zip
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
21
Suspicious files
1
Text files
56
Unknown types
31

Dropped files

PID
Process
Filename
Type
1652winlock.tmpC:\ProgramData\Crystal Office\WL\is-43D52.tmp —
MD5:—
SHA256:—
1652winlock.tmpC:\ProgramData\Crystal Office\WL\winlockl.dat —
MD5:—
SHA256:—
1652winlock.tmpC:\Program Files\WinLock\unins000.exeexecutable
MD5:5D7C03090ECBB6B973E257432A3D566E
SHA256:551E20F706BD2C6DF74DF02C0B8414723D2425BB5A07FE4A8FC8D9D2233EA617
3548winlock.exeC:\Users\admin\AppData\Local\Temp\is-UA4C5.tmp\winlock.tmpexecutable
MD5:5D7C03090ECBB6B973E257432A3D566E
SHA256:551E20F706BD2C6DF74DF02C0B8414723D2425BB5A07FE4A8FC8D9D2233EA617
3788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3788.27073\adguardinstaller.exeexecutable
MD5:0E94A2E6330D0672630AD1EA8FDA38B4
SHA256:C5A8E6E9ED8BFC442AB26B9CCA61784DC3D73A53925D040DBFAC825310BA98BC
1652winlock.tmpC:\Program Files\WinLock\elv.exeexecutable
MD5:87BB22BB80709CA2DDA659E4684E54CA
SHA256:CACD7B7A33805DAEAF9B15A69EAA4A06B97CA850358551F955805FAFA85F56B4
1652winlock.tmpC:\Program Files\WinLock\is-LR028.tmpexecutable
MD5:87BB22BB80709CA2DDA659E4684E54CA
SHA256:CACD7B7A33805DAEAF9B15A69EAA4A06B97CA850358551F955805FAFA85F56B4
1652winlock.tmpC:\Program Files\WinLock\is-FHLI5.tmpexecutable
MD5:150B29B89FF77889EF4A59EF3AAC3BD7
SHA256:A62ED0A37DF0644B367DD679E8AF2570F9C5CE3397B75EA84346382FF64CAF7E
1652winlock.tmpC:\Program Files\WinLock\is-C058P.tmpexecutable
MD5:5D7C03090ECBB6B973E257432A3D566E
SHA256:551E20F706BD2C6DF74DF02C0B8414723D2425BB5A07FE4A8FC8D9D2233EA617
3788WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3788.27073\winlock.exeexecutable
MD5:79D2EB09A31623DC3E6CC6B5834DC31E
SHA256:6C8057DAEB3E6F51FB6459F07C31C294A988323A6F67FC816045006F033F417C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.205.225.13:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132976028961320000
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
23.205.225.13:80
query.prod.cms.rt.microsoft.com
GTT Communications Inc.
NL
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.205.225.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
winlock.zip