eb64c7bebe3082bb715758b8afb73f80fe9eed7716ec4e77683f19dde95703e4

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Locker/LockerBuilder.pdb
Size 5KB
Sample260908-m16gmaydrb
SHA256 eb64c7bebe3082bb715758b8afb73f80fe9eed7716ec4e77683f19dde95703e4
MD5 f0932050f215619e31a3b5be50c266e1
SHA1 37e39bdbfe38f3e7a754bf71d2d60f8cb96987e1
SHA512 0057a26f12ab4a6c2677239bbd532e2e69308931b0c4a89b744c47fa4ef0c324c55b4032999b2ffb990c30097dd9140156a1e63229fa7b2820a50cebb88255e0
SSDEEP 96:g8zVmB5JM+7gvBZjhPkDvCEMXLCMxUZVHEiRpNrf2IVJxme:/O5JM+7uthPkDvOXLCt/7z2Ioe
TLSH
T145B1D81BF3105915DE4325756436634AD370D0B9E2049FE5A3C45B6CEDC53CBAEB22AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
816	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4048	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Locker\LockerBuilder.pdb
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads