c46acb7b3456efef3069ef2275330c81ea86c8e68c6d393d3f09ecf324f45fd4 | Triage™

Login
Reports

Overview

overview

9

Static

static

3

locker.exe

windows10-ltsc_2021-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
locker.exe
Size 3.0MB
Sample261102-tfza5sdv4k
SHA256 c46acb7b3456efef3069ef2275330c81ea86c8e68c6d393d3f09ecf324f45fd4
MD5 10599c5067ac4efee042af9f6bb09fe8
SHA1 c10cfd114bc32a6b0c2abaf39b9f22623f0c8907
SHA512 41f5e8c2cb17215e314d333e5253f7314f89f8b0f3039f0c95808eeba29374f765f0d521a0ea2e1fc04a80d15b3f52f008202d49195bdc5108e0bc4f97e7da9d
SSDEEP 49152:CvhoaufT1KeWBHCjhNqEcLNMT1ZQS5huGQYonJVBMfR:rrbT1ZQS5huGQYonJVBMfR
TLSH
T1C8E5E64369DB0DA9CED677BC61C75335A338FD718A291F2BA608C2312D536C4AE1EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

locker.exe

Resource

win10ltsc2021-20260911-en

windows10-ltsc_2021-x64

23 signatures

150 seconds

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Targets

- Target
  locker.exe
- Size 3.0MB
- SHA256 c46acb7b3456efef3069ef2275330c81ea86c8e68c6d393d3f09ecf324f45fd4
- MD5 10599c5067ac4efee042af9f6bb09fe8
- SHA1 c10cfd114bc32a6b0c2abaf39b9f22623f0c8907
- SHA512 41f5e8c2cb17215e314d333e5253f7314f89f8b0f3039f0c95808eeba29374f765f0d521a0ea2e1fc04a80d15b3f52f008202d49195bdc5108e0bc4f97e7da9d
- SSDEEP 49152:CvhoaufT1KeWBHCjhNqEcLNMT1ZQS5huGQYonJVBMfR:rrbT1ZQS5huGQYonJVBMfR
- TLSH
  T1C8E5E64369DB0DA9CED677BC61C75335A338FD718A291F2BA608C2312D536C4AE1EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomware

© 2018-2026

Terms | Privacy