cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker[.]exe

Analysis

max time kernel
85s
max time network
86s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-01-2025 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe

Score

10^/10

cryptolocker defense_evasion discovery persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1072	CryptoLocker.exe
4640	{34184A33-0407-212E-3320-09040709E2C2}.exe
4500	{34184A33-0407-212E-3320-09040709E2C2}.exe
3448	CryptoLocker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
35	raw.githubusercontent.com
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	firefox.exe
Token: SeDebugPrivilege	664	firefox.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe
664	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 652 wrote to memory of 664	652	firefox.exe	77
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4148	664	firefox.exe	78
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79
PID 664 wrote to memory of 4652	664	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/CryptoLocker.exe
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1860 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4051035-f48c-4ccc-9c38-cc91dda5f5aa} 664 "\\.\pipe\gecko-crash-server-pipe.664" gpu
    3⤵
    PID:4148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20240401114208 -prefsHandle 2328 -prefMapHandle 2324 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74086bdd-ec63-4e8d-8f0b-2c2e2bf2cc5f} 664 "\\.\pipe\gecko-crash-server-pipe.664" socket
    3⤵
    PID:4652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2688 -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 3000 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {622ef56f-81d9-4f42-82d7-73b6af4726ca} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3912 -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {750bd5a1-9515-4b80-b776-1d907d5adfa6} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:4780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4736 -prefMapHandle 4624 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4db3677a-95d6-494d-a333-357b020875e5} 664 "\\.\pipe\gecko-crash-server-pipe.664" utility
    3⤵
    - Checks processor information in registry
    PID:4492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -childID 3 -isForBrowser -prefsHandle 4980 -prefMapHandle 4944 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dd9263c-924c-46f7-8f96-7f7bff4115a5} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5792 -prefMapHandle 5788 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a45d9b0-a152-4dc3-add5-31a896a6831f} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5924 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5936 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5915fb8-6d52-4d76-a67c-e878a9d88d41} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:968
- - C:\Users\Admin\Downloads\CryptoLocker.exe
    "C:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:1072
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000000EC
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4500
- - C:\Users\Admin\Downloads\CryptoLocker.exe
    "C:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6528 -childID 6 -isForBrowser -prefsHandle 6524 -prefMapHandle 1480 -prefsLen 34632 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41254815-b238-4cc4-bce6-1766cd9fd346} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6856 -childID 7 -isForBrowser -prefsHandle 6740 -prefMapHandle 6844 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 996 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e00a966-8593-488f-9df5-f71c6541acdf} 664 "\\.\pipe\gecko-crash-server-pipe.664" tab
    3⤵
    PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
987aa72dfa350560dc2988df4a630cec

SHA1
f60f1fb3c5a45978988d187f07d1ae12b9003baa

SHA256
f6bda7426a4ddb173708b5645ad09fb4c705f5a527e92232537de83dbf12d3dc

SHA512
52ea07bd970cf103130eec6d06070f778c3ba1644719da6b27e6034b12c8c2f8cdba64f2b0dfac2b2cd5f1d5784e83759bf986ab3f994d74fc4006969cda6338

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
6KB

MD5
49cb555fefd0562a68ae30092b468007

SHA1
d887d1d500a6aaf543261d9188af32b3d78b7227

SHA256
bd5d2231cd549f762d2dc7a5db06b509e2445fdaefb981a25b677d1b6e2f3cc2

SHA512
6b9f2a881e67d81157b710d86dd2a3afdc584de6330ce39699cf11f5b87fadfeccc62461a6828dd3c6dc4b96a88ed40eaed58f10a7b3f78ac56582b5fdb9521d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
6KB

MD5
568f79e489a1d07c59f30453a2d59d27

SHA1
87b28b3ea450a13aa73c3b06b53c628f91925f79

SHA256
16630deccab3db0cc6b5ccbc1761df7e79c836672df24186264839330f0fd531

SHA512
f40f2bf674977adff07451cfc4385f5c166dfb99795e8c9d435a31b23f178dd665a88382e9991006ecf95f1c28847fe33b13ccc96e9c7f4c5f8f7640c02c3935

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\AlternateServices.bin

Filesize
8KB

MD5
3738b47ddf98c51603cfb74cfd7ff59b

SHA1
ef1479fa1f5010f0d8a84ca0bf46de27050ecc97

SHA256
6fae4fc36bf4b77de3583c90076b20bb4b3aa9458d8f8560753900188864f4cc

SHA512
47dd188e8dcbc6dd44f93cb99d994bc156cee072589db427d08ab0b720f2f5c54b7e9d069acea70a11758eb929cb9f75d70a0e9d7ced06d9b1abfb0eeb9ae793

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
3dbcf1b4f7d49cdc5c9b86a3a4bd8633

SHA1
d8216d36f83a3f5032308e6a0a2d0cc318a7a0b0

SHA256
9b97a38cf10e54996d15b640f1995ad2b97fd9c4adfd982df87c711c3087e092

SHA512
1531030c0210581b1e824df411594d48c24b4fda814df7bea2f5dcd7b366665c3ded05dc584298d7466957a736464a90cf48ed5330a80d1b1812d650d391eccc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
19191f135be8ba5d24cf860ae2f9b470

SHA1
16a496f3629168d05cb70eb0e9df8b05824de422

SHA256
e009636e69e611bf0100542c09a507ef47405a7836f897ece4f86fa7eca75031

SHA512
80e239c088624befd301c70865c894c49fced8bfa76b3e107196ce18dd9d5ebabfcd074c2c7c29642d2746f1fdd538e0de0db55c50c84542d746497e7b93633b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\625d89c5-e4b1-48a6-a748-172144baa97d

Filesize
24KB

MD5
2164b2170930cdc24093b3b4a00281a2

SHA1
281c2eb3c072659e9048b13386b6451166834f2f

SHA256
02c076a08915ac3ccf0e094f877fe7366d7a68b5641eddf860f45d7bcc447527

SHA512
558f2c395fedaa80dbb9d039779f873e9a4b72ee3f1ba57cbb8abed99fd14d9297080f3bbd1b821e1e9dcd325509c0cf8608ac490c560ed9c56abc34b0619161

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\84ff926e-11f9-4353-a4c7-c82cf3dd7c1b

Filesize
671B

MD5
5ab1f2c81ea93bca1dcf301bcdb99381

SHA1
839367d7266ecf0279729d3cef4f3f50dc134d52

SHA256
36703292e65674015a90dcb64edfc9caf6a7869cae45c98432d68b875cb14d62

SHA512
8c2af56005637da4257eda9a2bfc9b48957237108c0e22f452d471063b3db5c8145eaa9cd17433deefe2923ee9b3f347bc19caa9520939be87f481cc227f79de

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\datareporting\glean\pending_pings\ed94a47b-dcd5-429a-a6b5-e1afebcebdf0

Filesize
982B

MD5
224ec78cea6f4285196f6e3e125f4211

SHA1
dfbbd393090b4101dd768d3fc28e159273622d08

SHA256
136872847a69c08413ede40f8870168087d1a0c49ab6a9605a46700df598bfad

SHA512
a6c6fbd2398c7d7b1293f104d9c865fa93ff32aab0a0e4d252891d7cade005661ffd62569d3810e73d686cc89280ac447822a580819a5daa5a0bcd4a3ebe6477

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs-1.js

Filesize
10KB

MD5
7a22896c589be297dd32d9aa86bcc5ff

SHA1
d7d669df5a94ea5b75a21cfbc1e4a7b44ac201f3

SHA256
27b5df374a2232c72570205acda319b661545ce154cbebe3f49c6e55da2e0333

SHA512
e0c04a93e072cd94314a27ff42845741fad5198982ef2e8783154b181d8cbde2f508f2d375928a33fc126f440cde10314169cb59f5f20bffec6b2ae21097af23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs-1.js

Filesize
11KB

MD5
a7e15872e7d171524cab1e9145394637

SHA1
02a0d09f04c2639ee4194db2e6682409ee44ae91

SHA256
0f043ae561ac5f3133a0984b2b66e3e3c0039ba30c181a9adf3f123eff5ae3fb

SHA512
e138bba4c1a59097c327a98372c335b9c2b9c32c8364fc7c59e426344a60e015a754537615fa059b95195f630be4fba21e3bdddff983d39a698bdb212b3cf3ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\prefs.js

Filesize
10KB

MD5
f791caa75b5f275e8c0feebebc408aa5

SHA1
6824b85d2b42ffd4582d06a6b17f7c0946452767

SHA256
f5642c39ac6abfdf89ba4c85ea9ec5ebc1b84b85ca5c12716c78f7bab7b3ef47

SHA512
292b4a2aaa67a6759138d67c7510cfa9842fdc7722accdb7faaf24fd88988ccfc2f4e6d8413084020205957f5befc257f622322dcc5440ef576458826f2057d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
0e2d529bb22a04a7f84d63f228b42876

SHA1
609f528acd8ce5bcd3179047fd805ddd029eaa2a

SHA256
30f133abbfcc06f1b68a84d2191788093ab96482c108a4aa0e770cffb6e347bb

SHA512
e7685108ec81cc972313ca8b0fbf92700e12ffe06d4effb588b5eb0f2b50e316729febe80b23b63b1e3259f12c397f63f6c3cf15b334448578dd1141a04732e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a5a57a64719a330fef25340c36fc06d3

SHA1
e19a0d36350422080d23041068199d081df7207a

SHA256
af7d8b217236c8fd42f365130e40a0ca8dd82a7deeb18a69efb692ffe4748ddb

SHA512
f964b60a784dd07f677df72c29fd1cb231438f5b0826a2874412ca89a8c48ba3cd1ed61aea5d79beddb0eb69c93784f249cf8273191447888c58050832b680d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
8b0a209d4f9db3562b32e69a4a420112

SHA1
b71a72bc59f772214a696d466504630068fd5bab

SHA256
2327556a19a070f3e6086305667fa590236aac06ada4133a480d257b3212f671

SHA512
aa5ea6bb3aff5ec57e2c126555c8035dd1f39f39e43c4456f93706f358ad59a043898ca6041532934d82434397056ef15b773c565a0e1e4da3eaaa8aa99a3e30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\w9rzhd5e.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
e84d1c7e7fc7bfd88f208a407e6e8c55

SHA1
cc90120262d4521697feadabd95b47f3a30e1819

SHA256
984ce7a28e4d978de8c6fdc228a71873604cd9721600fdd544d34b74eb453124

SHA512
ce91fc2c69c63d10461b0098c9312a930962fe88cf687a18757d194ed7f986c72ea9cf1da434ebba0ba4f530cd40dfc0b2f5ae5d83ce5925757a9ba7019fe322

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads