{
  "family": "lockscreen",
  "sample_count": 27,
  "category": "ransomware",
  "description": "LockScreen (classified across security telemetries under signatures including Ransom:Win32/LockScreen, Trojan-Ransom.Win32.LockScreen, and Trojan.LockScreen) is an extortion screen-locker ransomware threat active since 2011. Typically delivered through drive-by downloads on compromised web pages and trojanized video codecs, LockScreen focuses on immediate denial of system usability. Upon execution, it modifies the Windows Shell registry value (HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell) to replace explorer.exe with its own binary. It disables the Windows Task Manager, Registry Editor, and Command Prompt, rendering the desktop inaccessible and displaying an unclosable full-screen alert. The extortion notice frequently impersonates law enforcement agencies (such as the FBI, Interpol, or local police), accusing the victim of viewing illicit content and demanding fine payments via prepaid cards or cryptocurrency.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/LockScreen",
    "Trojan-Ransom.Win32.LockScreen",
    "Trojan.LockScreen",
    "Win32/LockScreen",
    "Ransom:Win32/LockScreen.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/LockScreen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "LockScreen is an extortion screen-locker trojan that replaces the Windows shell and displays an unclosable lockscreen demanding payment."
      }
    },
    {
      "@type": "Question",
      "name": "Does LockScreen encrypt user personal files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, traditional LockScreen variants do not encrypt files; they deny access to the operating system by replacing explorer.exe and locking the screen."
      }
    },
    {
      "@type": "Question",
      "name": "How does LockScreen disable administrative recovery tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sets registry policies such as DisableTaskMgr and DisableRegistryTools to prevent victims from terminating its lockscreen process."
      }
    },
    {
      "@type": "Question",
      "name": "What social engineering tactic is used by LockScreen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It impersonates government agencies (FBI, police) claiming the victim engaged in illegal activity and must pay an immediate fine."
      }
    },
    {
      "@type": "Question",
      "name": "How can users bypass and remove a LockScreen infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Safe Mode with Command Prompt, revert the Winlogon Shell registry entry back to explorer.exe, and remove the malware binary."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1547.001",
    "T1562.001",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Drive-by Downloads on Compromised Sites",
    "Trojanized Video Codecs & Media Players",
    "Malicious Adware Bundlers"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Full-Screen Topmost Window Overlay",
    "Winlogon Shell Registry Hijacking",
    "Task Manager & Registry Tools Disablement",
    "Keyboard Shortcut (Alt+Tab, Ctrl+Alt+Del) Hooking",
    "Extortion Ransom Payment Interface Display"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (GUI Screen Locker)",
      "HTML / Flash Extortion Asset"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET requests retrieving localized law enforcement lockscreen banners based on victim geo-IP",
      "Outbound HTTP POST requests transmitting entered payment voucher codes or cryptocurrency transaction IDs"
    ],
    "evasion_techniques": [
      "Registering as an accessibility helper or replacement shell to execute prior to standard desktop applications",
      "Hooking low-level keyboard input to suppress Windows shortcut combinations"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5",
      "48e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
    ],
    "file_paths": [
      "%AppData%\\LockScreen\\locker.exe",
      "%Temp%\\police_notice.html"
    ]
  },
  "defensive_measures": [
    "Enforce registry monitoring to alert on changes to the Winlogon Shell value from default explorer.exe",
    "Deploy secure web gateways to block exploit kit landing pages and unauthorized codec downloads",
    "Educate users that legitimate law enforcement agencies never freeze computers or demand payment via gift cards or crypto"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/LockScreen",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/LockScreen"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_LockScreen",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/LockScreen.A",
      "Ransom:Win32/LockScreen.B"
    ]
  },
  "motivation": "Financial Extortion & Coercive Payment Demands",
  "sample_hashes": []
}