Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:58
General
- Target Winlocker_323688293_protected.exe
- Size 2.4MB
- Sample260506-vg366aey6v
- SHA256 8404231ecc32ae5d0e1eaea163e1c9dbcac96c8f1f662b3153160af5284dfadf
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Winlocker_323688293_protected.exe"C:\Users\Admin\AppData\Local\Temp\Winlocker_323688293_protected.exe"1⤵
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /query /tn "resolver"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /tn "resolver"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /delay 0000:00 /tn "resolverC:\Users\Admin\AppData\Local\Temp\Winlocker_323688293_protected.exe" /IT /RL HIGHEST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /delay 0000:00 /tn "resolverC:\Users\Admin\AppData\Local\Temp\Winlocker_323688293_protected.exe" /IT /RL HIGHEST3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\DefenderExclusion_ea9c0877-15fa-4d2e-baea-6f60f532d317.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DefenderExclusion_ea9c0877-15fa-4d2e-baea-6f60f532d317.ps1
__PSScriptPolicyTest_h1xczn3t.yjz.ps1
memory/1044-1-0x00000000059B0000-0x0000000005F56000-memory.dmp
memory/1044-2-0x0000000005400000-0x0000000005492000-memory.dmp
memory/1044-3-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1044-4-0x0000000005390000-0x000000000539A000-memory.dmp
memory/1044-5-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1044-49-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1044-48-0x0000000005640000-0x0000000005650000-memory.dmp
memory/1044-0-0x0000000000660000-0x00000000008C8000-memory.dmp
memory/4308-24-0x0000000007320000-0x0000000007354000-memory.dmp
memory/4308-35-0x0000000007740000-0x000000000775A000-memory.dmp
memory/4308-13-0x0000000005CE0000-0x0000000005D46000-memory.dmp
memory/4308-11-0x0000000005380000-0x00000000053A2000-memory.dmp
memory/4308-20-0x0000000005E10000-0x0000000006167000-memory.dmp
memory/4308-21-0x0000000006350000-0x000000000636E000-memory.dmp
memory/4308-22-0x00000000063A0000-0x00000000063EC000-memory.dmp
memory/4308-10-0x00000000054D0000-0x0000000005AFA000-memory.dmp
memory/4308-9-0x0000000004E90000-0x0000000004EA0000-memory.dmp
memory/4308-25-0x0000000070300000-0x000000007034C000-memory.dmp
memory/4308-32-0x0000000006950000-0x000000000696E000-memory.dmp
memory/4308-33-0x0000000007610000-0x00000000076B4000-memory.dmp
memory/4308-34-0x0000000007D80000-0x00000000083FA000-memory.dmp
memory/4308-12-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/4308-36-0x00000000077C0000-0x00000000077CA000-memory.dmp
memory/4308-37-0x00000000079D0000-0x0000000007A66000-memory.dmp
memory/4308-38-0x0000000007940000-0x0000000007951000-memory.dmp
memory/4308-39-0x0000000007970000-0x000000000797E000-memory.dmp
memory/4308-40-0x0000000007980000-0x0000000007995000-memory.dmp
memory/4308-41-0x0000000007A70000-0x0000000007A8A000-memory.dmp
memory/4308-42-0x0000000007A90000-0x0000000007A98000-memory.dmp
memory/4308-45-0x0000000004D30000-0x0000000004D49000-memory.dmp
memory/4308-47-0x0000000006190000-0x00000000061A8000-memory.dmp
memory/4308-46-0x00000000053B0000-0x000000000549A000-memory.dmp
memory/4308-8-0x0000000004D70000-0x0000000004DA6000-memory.dmp
memory/4308-7-0x0000000004E90000-0x0000000004EA0000-memory.dmp