Overview

overview

8

Static

static

3

CryptoLabCopy.exe

windows11-ltsc_2024-x64

8

Resubmissions

27/07/2026, 12:19

260727-pg6pdsstdx8

27/07/2026, 12:08

260727-pbb8laej717

26/07/2026, 23:15

260726-281zfaserc7

Analysis

  • user interaction
    yes
  • max time kernel
    611s
  • max time network
    431s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CryptoLabCopy.exe
  • Size 12.0MB
  • Sample260727-pg6pdsstdx
  • SHA256 23113047846a21ca79db7ab18c60701b1f820981c18fe55b786d6634e77e8b4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwareexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\CryptoLabCopy.exe
    "C:\Users\Admin\AppData\Local\Temp\CryptoLabCopy.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\CryptoLabCopy.exe
      "C:\Users\Admin\AppData\Local\Temp\CryptoLabCopy.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4620
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
      PID:3804
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:712
      • C:\Windows\System32\DataExchangeHost.exe
        C:\Windows\System32\DataExchangeHost.exe -Embedding
        1⤵
          PID:3632
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          1⤵
            PID:5868
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3944
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:5736
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3800
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3708

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\_bz2.pyd
                • Size 85KB
                • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _cffi_backend.cp314-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\_cffi_backend.cp314-win_amd64.pyd
                • Size 177KB
                • SHA256 2011ed3465ee2b732588c443c246f9c857288b8a0c59ea737100d230a5f8e346
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\_lzma.pyd
                • Size 157KB
                • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _zstd.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\_zstd.pyd
                • Size 491KB
                • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\base_library.zip
                • Size 1.3MB
                • SHA256 01ea32a10e05fcadeb944c20af79d9048c32e01e4e8198e0ef948a4a32f08428
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _rust.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\cryptography\hazmat\bindings\_rust.pyd
                • Size 9.4MB
                • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.DLL
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\python3.DLL
                • Size 72KB
                • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python314.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI12282\python314.dll
                • Size 6.5MB
                • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BackupSync.kix
                • Path C:\Users\Admin\Desktop\BackupSync.kix
                • Size 805KB
                • SHA256 c6fc7c1ac95b9d24eaaa61ba0906293b3d3d3343261ee2950abe130ad702e2d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CD Drive - Shortcut (2).lnk
                • Path C:\Users\Admin\Desktop\CD Drive - Shortcut (2).lnk
                • Size 304B
                • SHA256 ffa97e4d4dc0f4ace4c57e4d460f0387698a915e1de8090d89f896f674104e91
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CheckpointBlock.easmx
                • Path C:\Users\Admin\Desktop\CheckpointBlock.easmx
                • Size 863KB
                • SHA256 fb439bd3ec2b0df31df4842ef000e365a8567e3b28d6dc458bee72ebad31da58
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CheckpointGet.xlsx
                • Path C:\Users\Admin\Desktop\CheckpointGet.xlsx
                • Size 11KB
                • SHA256 3c8671324e717b6580a57186087cb7b5c6163b9583f085df29e32de4e7b3a284
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ConvertToUninstall.3gp
                • Path C:\Users\Admin\Desktop\ConvertToUninstall.3gp
                • Size 949KB
                • SHA256 3bfc22857ebc78546302e5c4c5edcb1891a9527dbf1521ca4f31bcffd03c69ef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DebugMove.dxf
                • Path C:\Users\Admin\Desktop\DebugMove.dxf
                • Size 719KB
                • SHA256 0f24c5483fd8d9a6442500f3de2e36fb1ced27ac15b39f585dff1c8919fda2b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                EnableInitialize.ppsx
                • Path C:\Users\Admin\Desktop\EnableInitialize.ppsx
                • Size 690KB
                • SHA256 55d4c28bfd7b8c21a8ce30961c5ca2cb34d30f13795ce122a25e67dc8a7e2bab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ExitSplit.vstm
                • Path C:\Users\Admin\Desktop\ExitSplit.vstm
                • Size 661KB
                • SHA256 937255b5c91321394bdc1f5ef8e4a21ecd064ac2f38a86dbe2b1f985d3a9fda4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                F (F) - Shortcut (2).lnk
                • Path C:\Users\Admin\Desktop\F (F) - Shortcut (2).lnk
                • Size 500B
                • SHA256 06d076f9fc9df9dc654960966ec918aba9b5db091ee0559325df129f70c1650c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                FindTrace.mid
                • Path C:\Users\Admin\Desktop\FindTrace.mid
                • Size 1.0MB
                • SHA256 77e7c2d31a942b58bac1da2d7ab7b71bf3cc1dca5b73315baf13298718b8fda2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ImportReceive.DVR
                • Path C:\Users\Admin\Desktop\ImportReceive.DVR
                • Size 489KB
                • SHA256 ca4403dd44fb0f42d91fdddfd989ea891e0bd350165a70db8fa7937cb0dbe54d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InitializeSplit.midi
                • Path C:\Users\Admin\Desktop\InitializeSplit.midi
                • Size 834KB
                • SHA256 bcaf23685a070cdf6c1ae3c8eaa5ade4e6afc8005a0229473d9d1385df0ea54b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InstallNew.mpeg
                • Path C:\Users\Admin\Desktop\InstallNew.mpeg
                • Size 431KB
                • SHA256 9bbab7c0778019e9e07d351f05286df827a41f739c0381e991a1e85571a0197e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LimitExpand.M2TS
                • Path C:\Users\Admin\Desktop\LimitExpand.M2TS
                • Size 460KB
                • SHA256 29973da3137ff5ae11b0bf0c4faeeef7651178b1f4a09eabeb98c3b2a3bda15e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MeasureOut.vst
                • Path C:\Users\Admin\Desktop\MeasureOut.vst
                • Size 604KB
                • SHA256 6060d1b1515191e5deb67a4653d126028cb6ca03605527edd9872206979da926
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MountShow.pptm
                • Path C:\Users\Admin\Desktop\MountShow.pptm
                • Size 1.0MB
                • SHA256 b46c3705ad5597244a0780045f45ae9d4bfeebd7bc03de09ca861c733941cb55
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PingUse.docx
                • Path C:\Users\Admin\Desktop\PingUse.docx
                • Size 18KB
                • SHA256 21e6532ebdd74f8c313f517b528e858e2a16ef70eca3653c3e1c4f0e0bbe1cd8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PublishEdit.reg
                • Path C:\Users\Admin\Desktop\PublishEdit.reg
                • Size 978KB
                • SHA256 7254f82fe54e37b771217e4b90763b447a41c99d258bca2cb2ed482abcfe96d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PushWait.odt
                • Path C:\Users\Admin\Desktop\PushWait.odt
                • Size 921KB
                • SHA256 ba7cae0d92b6bb3e34b14c21dc3d050097f3721ca3a6d018c24f7d83f6ba3f3d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ReadSet.cr2
                • Path C:\Users\Admin\Desktop\ReadSet.cr2
                • Size 1007KB
                • SHA256 1bd843cb926cd81bb2e8b761378606b849c6b1fc2821514405f7e4be8b479a3c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RedoConfirm.lock
                • Path C:\Users\Admin\Desktop\RedoConfirm.lock
                • Size 546KB
                • SHA256 ae3d34f78e12b782d3077dc26d6fbd397acbe5aa60959eaac81ba411cb726e0e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ResizeMove.rmi
                • Path C:\Users\Admin\Desktop\ResizeMove.rmi
                • Size 633KB
                • SHA256 edfd23ab15f9d5d169b83bb4f7618d7336eb96dab226adb89e83bf8e3a468410
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RestartPublish.wax
                • Path C:\Users\Admin\Desktop\RestartPublish.wax
                • Size 374KB
                • SHA256 6830c1569c45f33f82629fc8b9e4a1aa452e025cea28055c9057c298aa904a32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SaveUse.bmp
                • Path C:\Users\Admin\Desktop\SaveUse.bmp
                • Size 748KB
                • SHA256 bb388eab9f6bb652e3d4a8cbf2e05053be9451c09d04f442148056704ac659a6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SearchShow.ico
                • Path C:\Users\Admin\Desktop\SearchShow.ico
                • Size 402KB
                • SHA256 efb166fd0fc24eb780284c247c831a53df6056c8b5bd30bb9aa20ac18bd665ee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StepRequest.pptx
                • Path C:\Users\Admin\Desktop\StepRequest.pptx
                • Size 777KB
                • SHA256 81307baf7aaa3ce7664d65a2b273623270a9fee98c22023eca9cc0c1d12ec38e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StepSwitch.html
                • Path C:\Users\Admin\Desktop\StepSwitch.html
                • Size 575KB
                • SHA256 5c9e1b9f3a82e72c302b533600d3ad9e4ce9fafb52b5310e3318e32359f4a0f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StopImport.7z
                • Path C:\Users\Admin\Desktop\StopImport.7z
                • Size 1.4MB
                • SHA256 a87a8daa78ced0aa70897f746febdb77408f7381bfcf643f910355dd8050e0f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TraceUnblock.vdx
                • Path C:\Users\Admin\Desktop\TraceUnblock.vdx
                • Size 892KB
                • SHA256 500b80432dd954067918c91357566a94e6f946d082970b75f8ddc5dafa2f75db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TraceUnlock.wax
                • Path C:\Users\Admin\Desktop\TraceUnlock.wax
                • Size 518KB
                • SHA256 15b00bd8b64d08eccb9dd0e82f8c49a6b702d217cfd55fd412b435a41f6f8e6d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WatchGrant.xlsx
                • Path C:\Users\Admin\Desktop\WatchGrant.xlsx
                • Size 10KB
                • SHA256 02fb81ab204dda400381c96da0140c151c37236f2c45db8a8c05379bd83920ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Windows (C) - Shortcut (2).lnk
                • Path C:\Users\Admin\Desktop\Windows (C) - Shortcut (2).lnk
                • Size 536B
                • SHA256 168a5ccd2a61458db2f5126a490ec6fdd25f20630ce326e09693c6730854da56
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Windows (C) - Shortcut (2).lnk
                • Path C:\Users\Admin\Desktop\Windows (C) - Shortcut (2).lnk
                • Size 536B
                • SHA256 8eee9774ee851ab25eb4e5cc5157916e8c58e55fc4cd04fca758826f231c1943
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Windows (C) - Shortcut.lnk
                • Path C:\Users\Admin\Desktop\Windows (C) - Shortcut.lnk
                • Size 536B
                • SHA256 51847330a21a2fa7ce25b5d9995f721a84cccc3ab11bdae4f6ffab118c9a4a1e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Acrobat Reader DC.lnk
                • Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                • Size 2KB
                • SHA256 43d4beb6287874d60d017ab5bf52cf5c1a53c127ddefacdfcc14437b8d392428
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Firefox.lnk
                • Path C:\Users\Public\Desktop\Firefox.lnk
                • Size 1KB
                • SHA256 7b1dcd47287962e275bace64ea5ddd1d209d4af9ec7321bc6163df36bcad140a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Google Chrome.lnk
                • Path C:\Users\Public\Desktop\Google Chrome.lnk
                • Size 2KB
                • SHA256 c25a9e04897dcb7adc56c373aa089f8200c65b136c7409630d13026b34c6df89
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                VLC media player.lnk
                • Path C:\Users\Public\Desktop\VLC media player.lnk
                • Size 923B
                • SHA256 71e58dbb7fc7f06ec50526ffd7777515d3b204414da10bc1176e3f8216e9088a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/3800-91-0x000001D0001E0000-0x000001D0002E0000-memory.dmp
                Download

                memory/3800-123-0x000001D001D40000-0x000001D001D60000-memory.dmp
                Download

                memory/3800-137-0x000001D0142E0000-0x000001D014300000-memory.dmp
                Download

                memory/3800-96-0x000001D001A00000-0x000001D001A20000-memory.dmp
                Download

                memory/3800-97-0x000001D001E20000-0x000001D001F20000-memory.dmp
                Download