b1fb231d58e2c6d1ac698f34a1d699d857084f17a0dbd92d11a33c7420a4cf15 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

WinterWate...1.0.js

windows10-2004-x64

3

WinterWate...1.0.js

windows11-ltsc_2024-x64

3

WinterWate....0.bat

windows10-2004-x64

3

WinterWate....0.bat

windows11-ltsc_2024-x64

3

WinterWate...1.1.js

windows10-2004-x64

3

WinterWate...1.1.js

windows11-ltsc_2024-x64

3

WinterWate...rt.cmd

windows10-2004-x64

8

WinterWate...rt.cmd

windows11-ltsc_2024-x64

8

WinterWate...er.bat

windows10-2004-x64

3

WinterWate...er.bat

windows11-ltsc_2024-x64

3

WinterWate...er.exe

windows10-2004-x64

1

WinterWate...er.exe

windows11-ltsc_2024-x64

1

WinterWate...er.exe

windows10-2004-x64

8

WinterWate...er.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
WinterWatercooler-0.4.0.zip
Size 270KB
Sample261110-p4ppdstvg1
SHA256 b1fb231d58e2c6d1ac698f34a1d699d857084f17a0dbd92d11a33c7420a4cf15
MD5 0635dd4e404776bdf9f68c21d2d8c796
SHA1 2eb252d437e8050fdbee423cbae8e7a560c66604
SHA512 95930fd1a033a730cf39e220d54d321fd998ac883a12635e680f12dd23362de26598ba46b75a116644ca06300e6da8906391d74b33ef11bf0a1382a042e9c655
SSDEEP 6144:wXUWo9VZzao04L3z7gLL2rppbdn8FRiXJ8J3cLz8NhGrlAgnkS:Pv9VZzaob2L2rnmy8J3cLgN0oS
TLSH
T1994423D388DF200CC3E5D870F5C55B0B81E1C21AE6E8A58DFA4347ECC9A96D6A355A89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

WinterWatercooler/Libs/CallbackHandler-1.0/CallbackHandler-1.0.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

WinterWatercooler/Libs/CallbackHandler-1.0/CallbackHandler-1.0.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

WinterWatercooler/Libs/LibDBIcon-1.0/LibDBIcon-1.0.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

WinterWatercooler/Libs/LibDBIcon-1.0/LibDBIcon-1.0.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

WinterWatercooler/Libs/LibDataBroker-1.1/LibDataBroker-1.1.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

WinterWatercooler/Libs/LibDataBroker-1.1/LibDataBroker-1.1.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

WinterWatercooler/Start.cmd

Resource

win10v2004-20260911-en

windows10-2004-x64

13 signatures

150 seconds

discovery execution

Behavioral task

behavioral8

Sample

WinterWatercooler/Start.cmd

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

14 signatures

150 seconds

discovery execution persistence ransomware

Behavioral task

behavioral9

Sample

WinterWatercooler/WinterWatercooler.bat

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

WinterWatercooler/WinterWatercooler.bat

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

WinterWatercoolerCompanion/WinterWatercooler.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

WinterWatercoolerCompanion/WinterWatercooler.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

WinterWatercoolerCompanion/WinterWatercooler.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral14

Sample

WinterWatercoolerCompanion/WinterWatercooler.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

13 signatures

150 seconds

discovery persistence ransomware

Malware Config

Targets

- Target
  WinterWatercooler/Libs/CallbackHandler-1.0/CallbackHandler-1.0.lua
- Size 7KB
- SHA256 d8a175f5823a999d8a188ee5e8e1133c393fd8c25b71931ab929d4691eff750b
- MD5 3757ba9ef62c5ee38d9246bce316b5a6
- SHA1 43c251e2ab846a8c8567149dce54c3ec28d6d1b9
- SHA512 a3939225934e09d9b8f2a4182c17813991bb5f4450839af848584f17f7e0e24b9ff089c35ed229674db10e179a1fb5abbfc179567364aea9c42c5088504ebfb8
- SSDEEP 192:ta+Vx0jCjmh6fMM4uIw7pfDOQoj8pAcBufX8FKc2usmyFjrw0BlC1LK0FKyWXk:taMVGIpyludyFrXk
- TLSH
  T180F1F00EBD0FC7534EC8E22DD937456AEA2FC0E4241E5601E9E85FF7115552D923A8E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  WinterWatercooler/Libs/LibDBIcon-1.0/LibDBIcon-1.0.lua
- Size 20KB
- SHA256 bd9249c720b511f1ca23f45ac1117c079b054060d764550efe04875d8d9e26bc
- MD5 4283a1c2660b3fec58663044a0f4908a
- SHA1 011f154f996a041d72b6a3e6274c664ede828305
- SHA512 7b953d7064e1dc73a2815fdd8e7781749ce0a60fbb752e7ece030a84e0e59c9c108ab9704c55f875e6531a24fadd710d7b105bd4e5936c15c75d76bf6c66fd28
- SSDEEP 384:RMLvtHM4SLoFpzpnRQQPwzfDVcqaXtGaHnQaC90eovbH/vDFE25/kxHsOCyLIYne:RqvtHM4SLoFdpRQQPw/92tG6QaC90eoL
- TLSH
  T1329252A9FE0A93207F82F424847BCD00FA2AD064D835B6256596D4F360E1D3C956EEE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  WinterWatercooler/Libs/LibDataBroker-1.1/LibDataBroker-1.1.lua
- Size 3KB
- SHA256 d79b3eada649684543bbbc3c511c2515e16d644f198fa991a201ee64d045b0f2
- MD5 ff28faeb5d0defa77d4e7c5355dbf3f4
- SHA1 64a35dafee09e2c0dfac41d128af59e6aa34456d
- SHA512 80e2d12a06c899c0232cfaac27f63c6e3fb2aa2541a410e26c378c334fc44f25ede47d0d9f9bb2af91da7776cdfa7db0781ba1c21d9910009eaedcc658887b27
- TLSH
  T19F61DF78B14792E36CA3027AD035A905E5F9F58036BF5210E1FAD3A65C0C409F6B5DE6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  WinterWatercooler/Start.cmd
- Size 298B
- SHA256 40ab94a6fcac7acfc43906424cbd8e2a8d0b2d48e878a288b6c76aaa45e2225e
- MD5 7bdfe950cd6ebfbe56e08a517ab4dfbf
- SHA1 f5b82c9472cac955aa1e1d36fee40a9e6dde638c
- SHA512 00b9bab04a7478dd0ac7998632dee6c23da06f542c42d2781fc65192799e2e6dcc1054580ba2a04b3ca1f600a174acc7fd862e3f12b00cb82132a7d1a4868115
- TLSH
  T11FE08CC8A09A262DA3210F280B0855C9E496835A7193136031019AACD6CF2EDA0DCBDC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence ransomware
- Downloads MZ/PE file
- Loads dropped DLL
behavioral7 behavioral8
- Target
  WinterWatercooler/WinterWatercooler.lua
- Size 35KB
- SHA256 0c91b0290722de309910dfd491c2e176d52cde205c2708e04e4a395ebe4d9123
- MD5 318914643d0e0b32650d7b38129b4996
- SHA1 2295afc784ce3a5de216079d681022634df20e3d
- SHA512 8f7a8134c1cbc4d70eb2df77b9a0cedefd19f3ac54291150392ba91a70d7cdbb82132ea5778fb7a19f2bc0ec0c6717b38202c311d3ffd973d4cb506922e85591
- SSDEEP 768:i+mErsai6eut7jW8y/n2YRWlAE7K/kvW7zC+wyd0dmM7prPFcXTUQ1OPGDRHooOV:m4827i4wszBq0P7DNv1Dz
- TLSH
  T1AEF2C6D772532179EEB29AA4C8430100F659057321BF05A4B82D95DE2FFA6EC42B5BFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  WinterWatercoolerCompanion/WinterWatercooler.dll
- Size 43KB
- SHA256 b8c85ff515ee2dca492351142b81f5fe485440c5bf7b5dca261112a98b5ef2a7
- MD5 d4b2bfb989533c4440e21d4bdbcc21d2
- SHA1 be03ce2bea01c46213a6bf73b95983eef9ef6f93
- SHA512 3df2e94d69cc31058257a45f5164e5a1139a0772fad9b0ef3ac630f1255435d4690a24c8f5c82fa77190cd9a3e2e2631d4773da9d4a44df2546278526f1b0936
- SSDEEP 768:iwSKlrhKBoaLAgDiUcgAOzds1NaMaGFeu6uVGtMWP8:llrhmlLmqeva+N6uMtdP8
- TLSH
  T1FA133A0477EA8227FBFE1B79B472512447B1FA5A3131EBAE8D9168BE1E637440D00793
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  WinterWatercoolerCompanion/WinterWatercooler.exe
- Size 158KB
- SHA256 61e2c7414ff10a7e6754364132e82269b6e94fbc73006ecd8bd548d267595665
- MD5 0c79f7ed0312ac00ce51ec5e0bd529c1
- SHA1 f9d62e26d8b8c8f62a796eb3fff941088df75cce
- SHA512 a2b03abe4b57171b5a6aca437604c8639c9fd6787d25825016b24457ceb8457460e9fe8046a5c3c8c8a8949ebe7d021ecc450c901400dd6704938365a44a2959
- SSDEEP 3072:UVDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbzaAT5th:wHRu7F1nQnB8KKy
- TLSH
  T11FF33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

discoveryexecution

behavioral8

discoveryexecutionpersistenceransomware

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

discoverypersistenceransomware

© 2018-2026

Terms | Privacy