{
  "family": "wlock",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nWlock is a destructive Ransomware variant (often functioning as a \"Screen Locker\"). Its primary objective is to extort money from the victim by either encrypting user files or completely locking the user interface (the Windows desktop), demanding a cryptocurrency payment (or prepaid vouchers) in exchange for restoring access to the system or data.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nWlock is typically distributed via spam campaigns with malicious attachments, malvertising, or brute-force RDP (Remote Desktop Protocol) attacks against internet-facing servers.\n\nUpon execution, Wlock forcefully denies access to the system:\n<ul>\n<li><strong>Screen Locking Mechanism:</strong> If operating as a locker, Wlock modifies the Windows Registry (often hijacking the `Winlogon\\Shell` key) to load its own full-screen application instead of the standard `explorer.exe` desktop. This completely prevents the user from accessing the Start menu, taskbar, or any files.</li>\n<li><strong>File Encryption (Crypto-variant):</strong> If operating as a standard crypto-ransomware, it rapidly enumerates the hard drive and network shares, encrypting documents, photos, and databases utilizing strong encryption algorithms (like AES or RSA). The original files are deleted, leaving only the encrypted versions.</li>\n<li><strong>Extortion Demand:</strong> The malware displays a persistent, intimidating ransom note (often claiming to be from law enforcement or utilizing aggressive countdown timers) instructing the victim on how to purchase cryptocurrency and transfer the funds to the attacker.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Wlock infection is a critical security incident resulting in an immediate denial of service and potential total data loss. It completely halts business operations on the infected endpoint.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Network Isolation:</strong> Disconnect the infected machine immediately to prevent the ransomware from spreading to mapped network drives or other devices on the LAN.</li>\n<li><strong>Safe Mode Bypass (For Lockers):</strong> If Wlock is acting purely as a Screen Locker, booting the machine into \"Safe Mode with Command Prompt\" or using an offline bootable rescue disk can often bypass the locker application, allowing an administrator to remove the malicious registry keys and delete the executable.</li>\n<li><strong>Data Restoration (For Crypto):</strong> If files have been encrypted, paying the ransom is strongly discouraged, as it funds criminal enterprises and does not guarantee a decryption key. The only reliable remediation is a complete wipe and re-image of the system, followed by data restoration from secure, offline backups.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Wlock",
    "Trojan.Ransom.Wlock",
    "WinLock"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1489",
    "T1547.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:31:23Z",
  "type": "Ransomware / Screen Locker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}