65ed0da4e7b6df10b27fcc5196968103b6a9582c36e454c763f47cb702001bfb | Triage™

Login
Reports

Overview

overview

Static

static

3

WinLock.exe

windows10-2004-x64

WinLock.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

Target
WinLock.exe
Size 4.9MB
Sample260825-wfzb9adj5s
SHA256 65ed0da4e7b6df10b27fcc5196968103b6a9582c36e454c763f47cb702001bfb
MD5 64cbeb729855a8d75a673bfeec4c1723
SHA1 da2513d9c70fec53ad7ef5efeafc470cd9955366
SHA512 6ac7c864e43000dc849e93277c1ef965d7c7f9ad5a522d0176b330265c33744e2a5dc5549e33a39a2d60798f00bd42ab4766449ca12457a44429cef875b0979f
SSDEEP 98304:GDl9celpkV8hSJrWoNoIoLCae0ZXvgC2B/e:GLblpkV8hWrWKoIOpTfgC
TLSH
T12836338D5AB33B7FF0294A392D3F69D0E1F269485824D8CF486CDAD446AFA421F0571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

WinLock.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

defense_evasion discovery persistence

Behavioral task

behavioral2

Sample

WinLock.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

defense_evasion discovery persistence

Malware Config

Targets

- Target
  WinLock.exe
- Size 4.9MB
- SHA256 65ed0da4e7b6df10b27fcc5196968103b6a9582c36e454c763f47cb702001bfb
- MD5 64cbeb729855a8d75a673bfeec4c1723
- SHA1 da2513d9c70fec53ad7ef5efeafc470cd9955366
- SHA512 6ac7c864e43000dc849e93277c1ef965d7c7f9ad5a522d0176b330265c33744e2a5dc5549e33a39a2d60798f00bd42ab4766449ca12457a44429cef875b0979f
- SSDEEP 98304:GDl9celpkV8hSJrWoNoIoLCae0ZXvgC2B/e:GLblpkV8hWrWKoIOpTfgC
- TLSH
  T12836338D5AB33B7FF0294A392D3F69D0E1F269485824D8CF486CDAD446AFA421F0571B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence
- Modifies WinLogon for persistence
  persistence
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence

© 2018-2026

Terms | Privacy