General
- Target cryptolock.exe
- Size 1.9MB
- Sample260815-3erpcavgjc
- SHA256 c99403f03eac21f143b2174ceee1086c6064640b03f5e94d09f49e9bfef412c7
- MD5 0cb2a02a809de79aa7e570cf5b3954c6
- SHA1 5d50dfb0b2315797510afb4c7be12d2d784887eb
- SHA512 1266a24f7810f676d0b7814f8277bbd06a4d7eb53014897254bdb9a87406eb37503ced6b0b54612fd79cdbcd7d7bc996774acd89562ab3b3da72c5744b6ef15f
- SSDEEP 24576:1J2QAYqgcWnVgKWEbZO8/aAYOeGh7qrrQtgUJ2rNwRoYFM3VIH06iy:1JmYqInJWYZOFAYOziQuU+Io2YIU6i
- TLSH T177957C03E69984FAC59EC078C3579532BA32B88D0B34B6EF1BD486203E67B905F1D759
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cryptolock.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cryptolock.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target cryptolock.exe
- Size 1.9MB
- SHA256 c99403f03eac21f143b2174ceee1086c6064640b03f5e94d09f49e9bfef412c7
- MD5 0cb2a02a809de79aa7e570cf5b3954c6
- SHA1 5d50dfb0b2315797510afb4c7be12d2d784887eb
- SHA512 1266a24f7810f676d0b7814f8277bbd06a4d7eb53014897254bdb9a87406eb37503ced6b0b54612fd79cdbcd7d7bc996774acd89562ab3b3da72c5744b6ef15f
- SSDEEP 24576:1J2QAYqgcWnVgKWEbZO8/aAYOeGh7qrrQtgUJ2rNwRoYFM3VIH06iy:1JmYqInJWYZOFAYOziQuU+Io2YIU6i
- TLSH T177957C03E69984FAC59EC078C3579532BA32B88D0B34B6EF1BD486203E67B905F1D759
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies boot configuration data using bcdedit
-
Creates new service(s)
-
Disables service(s)
-
Stops running service(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1