7d6496ba25229251c710efb3e6480961087f1e19dcb1fc00e9747db5d0b90ae9 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

WinlockerBulid.exe

windows10-2004-x64

8

WinlockerBulid.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
WinlockerBulid.exe
Size 30KB
Sample260808-n6npfaeq7v
SHA256 7d6496ba25229251c710efb3e6480961087f1e19dcb1fc00e9747db5d0b90ae9
MD5 58e75ce421a3522e95c73da8a5d2a077
SHA1 72744b32aab206bf1f8d98f062584aa6a14848fc
SHA512 606c70bfaab7556d5b5285efcd95c0b94d1600cb8df05cd2b85962ef54c6c12a501b6de152c472c9964729eac8e2ded540a983fb27d2d12cc3276d51b2f92f25
SSDEEP 384:hWupqAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDjoopehMff3F15hg7CZEOwY:orQEc+cDTlSPoopeiNhY6UFAT
TLSH
T19DE2328133FD1C2BDB39D6F502361A2913F7955A1811E7E91CCAE9CB14EEF400694EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

WinlockerBulid.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion discovery persistence

Behavioral task

behavioral2

Sample

WinlockerBulid.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

defense_evasion discovery persistence

Malware Config

Targets

- Target
  WinlockerBulid.exe
- Size 30KB
- SHA256 7d6496ba25229251c710efb3e6480961087f1e19dcb1fc00e9747db5d0b90ae9
- MD5 58e75ce421a3522e95c73da8a5d2a077
- SHA1 72744b32aab206bf1f8d98f062584aa6a14848fc
- SHA512 606c70bfaab7556d5b5285efcd95c0b94d1600cb8df05cd2b85962ef54c6c12a501b6de152c472c9964729eac8e2ded540a983fb27d2d12cc3276d51b2f92f25
- SSDEEP 384:hWupqAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDjoopehMff3F15hg7CZEOwY:orQEc+cDTlSPoopeiNhY6UFAT
- TLSH
  T19DE2328133FD1C2BDB39D6F502361A2913F7955A1811E7E91CCAE9CB14EEF400694EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence

© 2018-2026

Terms | Privacy