{
  "family": "screen",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\n\"Screen\" (often categorized as ScreenLocker or Winlock) refers to a specific subclass of Ransomware that primarily aims to extort victims by denying access to the operating system's graphical user interface (GUI), rather than encrypting the underlying files. While technically less sophisticated than crypto-ransomware, ScreenLockers are highly disruptive and rely on intense psychological pressure to coerce payment.\n\n<h3>Infection Vector and Lock Mechanisms</h3>\nScreenLockers are frequently distributed via malvertising, drive-by downloads on compromised websites, or masquerading as legitimate software updates (like fake Adobe Flash Player installers).\n\nUpon execution, the malware immediately seizes control of the user's display:\n<ul>\n<li><strong>Interface Hijacking:</strong> The malware forces a full-screen application to the foreground, completely obscuring the Windows desktop. It actively disables keyboard shortcuts (like Alt+Tab, Ctrl+Alt+Del, and the Windows Key) to prevent the user from closing the lock screen or accessing the Task Manager.</li>\n<li><strong>Psychological Coercion:</strong> The lock screen typically displays a highly intimidating message. A common tactic involves masquerading as a local law enforcement agency (e.g., the FBI or local police), accusing the victim of downloading illegal content, and demanding a \"fine\" to be paid via untraceable methods like prepaid gift cards or cryptocurrency.</li>\n<li><strong>Persistence:</strong> The malware modifies registry keys (such as `Winlogon\\Shell`) to ensure the lock screen launches immediately upon system reboot, before the legitimate `explorer.exe` process can start.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile highly disruptive to the individual user, ScreenLockers generally do not encrypt the underlying file system. Therefore, the data remains intact, provided the machine is not hastily formatted. However, the presence of a ScreenLocker indicates a failure in perimeter and endpoint security.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Safe Mode Boot:</strong> The primary remediation tactic is to reboot the infected machine into \"Safe Mode with Command Prompt.\" This bypasses the malware's registry persistence hooks, allowing an administrator to manually delete the malicious executable and repair the `Winlogon` registry keys.</li>\n<li><strong>Offline Scanning:</strong> If Safe Mode is also locked, the machine must be booted from a clean, offline Antivirus Rescue USB drive to scan and remove the infection without loading the compromised host operating system.</li>\n<li><strong>Do Not Pay:</strong> Payment should never be made. It funds criminal enterprise, and there is no guarantee the attackers will provide the unlock code.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan-Ransom.Win32.Screen",
    "ScreenLocker",
    "Winlock"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1112",
    "T1489"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:35:09Z",
  "type": "Ransomware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}