Analysis
- user interaction
yes - max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Cryptical.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cryptical.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target Cryptical.exe
- Size 159.4MB
- Sample260416-lwwwysfv21
- SHA256 d0885ce002d9229feafb6c529cbd732193e67ba8348c9e80eef55845aee8508d
- MD5 6ce42126cf9258952099fd0354aa3ffd
- SHA1 69ea5b77e3d83bfc2416a008bf74fdfa885a2d96
- SHA512 bd7ec315d35d39890ce451c6e9f7c241190137f1494890b20bffa8a84917323bb03fd0436be960181e49a460d574b1564c338cfcfa884090f17f3095119e957c
- SSDEEP 786432:15g85nOUvDVZkv+V5OtsFltqHxbSs8cfrXp5mRr+h04Y2bmYE4yRIS+vP:k85npvB+v+z29SsFfjp58yEY5ye
- TLSH T12C888D01A3E85E56D63F8278D2738261E6B1FC425351D2CF1084FA5A3FB77C27A36266
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000\Control Panel\International\Geo\Nation Cryptical.exe - Loads dropped DLL 4 IoCs
pid Process 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe 4780 Cryptical.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4780 Cryptical.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4780 Cryptical.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4780 Cryptical.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 Cryptical.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cryptical.exe"C:\Users\Admin\AppData\Local\Temp\Cryptical.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4780
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe"1⤵PID:2124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\Cryptical\TQDNfNPNT4HnC9lghhyJu8_PP1TrWaA=\D3DCompiler_47_cor3.dll
- Size 4.7MB
- SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
- MD5 a7349236212b0e5cec2978f2cfa49a1a
- SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
- SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
- SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
- TLSH T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\Cryptical\TQDNfNPNT4HnC9lghhyJu8_PP1TrWaA=\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 522667ff197f31dff56d32cdd0aa9a3120222989f0e4eb8a06de550ff55bcd70
- MD5 c9e8eea76fff652ef726a96f70d1d249
- SHA1 a33f7a31dc6e3bb85fba21c669ca5b14ffffd533
- SHA512 50dd6c922036209bd0b99af40ffc7db870089550854d592c65039d90942fab0dda289c9320babaa714078546e28f18fc299855335168bb456d0b8beb22c341ab
- SSDEEP 24576:el8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg93:eH6emPXrYCqX4T3Q1Niqzc74xb4izMpV
- TLSH T160453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\Cryptical\TQDNfNPNT4HnC9lghhyJu8_PP1TrWaA=\cimgui.dll
- Size 942KB
- SHA256 8a8464f3707d59ed5d63d3102eb81d1a60bf844745dd2d87f064940dfb87108c
- MD5 de06932e291c6fca15ae30601311df54
- SHA1 b85336c90d15f7d56e1ad8a4466c13ce68b17827
- SHA512 3e915f284748fb6531a16e30f38fadf5039f83478e21f042fbbe5990af1b5d230cb21d3dc637efacaa7b849ca7daf70907429e544e25f0b151890eb2117e39e8
- SSDEEP 24576:bRxUQXE+RJ6FfTbg4qm2YJBH1HT9lWePnb2I:bFX9R8qmNT9lWOnb2
- TLSH T172259E96E1B001E8D47AA0B8A1A7731BF671346417118AC723E4569C7FF3BE523FA391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\Cryptical\TQDNfNPNT4HnC9lghhyJu8_PP1TrWaA=\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 7972840d3221125f692622ed9c84a9ad78a797a9811d11e52b3f65759d0ccdc3
- MD5 ff02df17a2e3316cccc50a6d2caf5d5c
- SHA1 5ff43301617185473b3f3c364849fb067caaaf68
- SHA512 f21e1a06c9e0a0957a6d0d0d6eb47486c1bcfb5dd91b668081b2be849994a680b170a954230148066cae9b144375b2a1f03583189c8103dd6775954fdd0bb56e
- SSDEEP 24576:cp3YLMLrT18UP2HTePBDpuZiV1/QcqylsQdS/etT4ZdSAcMGuOk8SzXlTz:nm3iUP2HKBDpuSUypM2tWdSAc5uOqTB
- TLSH T1CD953A4676EC40EAD47AE23CDAD7461BF27278142761A7CF23A0479D6F27BD0097A360
- MD5 SHA1 SHA512 SSDEEP TLSH