Analysis
- user interaction
yes - max time kernel
900s - max time network
903s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/05/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CryptoLocker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral2
Sample
CryptoLocker.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
900 seconds
General
- Target CryptoLocker.exe
- Size 338KB
- Sample260524-nap8dsbs7p
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- MD5 04fb36199787f2e3e2135611a38321eb
- SHA1 65559245709fe98052eb284577f1fd61c01ad20d
- SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
- TLSH T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: CryptoLocker
Ransomware family with multiple variants.
- Deletes itself 1 IoCs
pid Process 2664 {34184A33-0407-212E-3320-09040709E2C2}.exe - Executes dropped EXE 3 IoCs
pid Process 2664 {34184A33-0407-212E-3320-09040709E2C2}.exe 4000 {34184A33-0407-212E-3320-09040709E2C2}.exe 4408 {34184A33-0407-212E-3320-09040709E2C2}.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe" {34184A33-0407-212E-3320-09040709E2C2}.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CryptoLocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {34184A33-0407-212E-3320-09040709E2C2}.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2004 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2004 taskmgr.exe Token: SeSystemProfilePrivilege 2004 taskmgr.exe Token: SeCreateGlobalPrivilege 2004 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe 2004 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3120 wrote to memory of 2664 3120 CryptoLocker.exe 85 PID 2664 wrote to memory of 4000 2664 {34184A33-0407-212E-3320-09040709E2C2}.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\CryptoLocker.exe"C:\Users\Admin\AppData\Local\Temp\CryptoLocker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\CryptoLocker.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002203⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4000
-
-
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exeC:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4408
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
- Size 338KB
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- MD5 04fb36199787f2e3e2135611a38321eb
- SHA1 65559245709fe98052eb284577f1fd61c01ad20d
- SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
- TLSH T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383
- MD5 SHA1 SHA512 SSDEEP TLSH