8404231ecc32ae5d0e1eaea163e1c9dbcac96c8f1f662b3153160af5284dfadf | Triage™

Login
Reports

Overview

overview

8

Static

static

3

Winlocker_...ed.exe

windows10-2004-x64

8

Winlocker_...ed.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
Winlocker_323688293_protected.exe
Size 2.4MB
Sample260506-vg366aey6v
SHA256 8404231ecc32ae5d0e1eaea163e1c9dbcac96c8f1f662b3153160af5284dfadf
MD5 0107fb4d67b929eaa87f5e859e1361a8
SHA1 0c1b13cce3072426fa98fdbcc583243ef07fd7cd
SHA512 16de55c05832d7d0f2fe14c15ab1fd2a2d16993fc6f4840eb2f57d90eaaf4d96e89ad9a654a4a722621391a2e2e41500f29b2a3df52afe6937aee8a8c1a0299c
SSDEEP 24576:Abiw35I6GND7l4BvPshamGD1FFM+4rKb3/XCi8I/G09oODtjKpwvLecIUetLTaYc:AbiTha51TM+r3qKvoCjK0xIU2LTXFe
TLSH
T147B56F5CDEC16A62EC2F46B14E161BEC6FF1BD927A6053CA27EF29DC838D2D12D46404
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

Winlocker_323688293_protected.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

11 signatures

150 seconds

defense_evasion discovery execution persistence

Behavioral task

behavioral2

Sample

Winlocker_323688293_protected.exe

Resource

win11-20260130-en

windows11-21h2-x64

11 signatures

150 seconds

defense_evasion discovery execution persistence

Malware Config

Targets

- Target
  Winlocker_323688293_protected.exe
- Size 2.4MB
- SHA256 8404231ecc32ae5d0e1eaea163e1c9dbcac96c8f1f662b3153160af5284dfadf
- MD5 0107fb4d67b929eaa87f5e859e1361a8
- SHA1 0c1b13cce3072426fa98fdbcc583243ef07fd7cd
- SHA512 16de55c05832d7d0f2fe14c15ab1fd2a2d16993fc6f4840eb2f57d90eaaf4d96e89ad9a654a4a722621391a2e2e41500f29b2a3df52afe6937aee8a8c1a0299c
- SSDEEP 24576:Abiw35I6GND7l4BvPshamGD1FFM+4rKb3/XCi8I/G09oODtjKpwvLecIUetLTaYc:AbiTha51TM+r3qKvoCjK0xIU2LTXFe
- TLSH
  T147B56F5CDEC16A62EC2F46B14E161BEC6FF1BD927A6053CA27EF29DC838D2D12D46404
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistence

behavioral2

defense_evasiondiscoveryexecutionpersistence

© 2018-2026

Terms | Privacy