1c215f9b10e1a2a1038abc31b012416ccd9e0d2870d1608cb64c16278c04a4d6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cryptolock_test.exe
Size 1.9MB
Sample260816-an4faaad88
SHA256 1c215f9b10e1a2a1038abc31b012416ccd9e0d2870d1608cb64c16278c04a4d6
MD5 254703df81b4d57af80f4a073c28dcc0
SHA1 ed7a7a8488944a9e3325f01d541b52f9175263cd
SHA512 565bdcc1cddcc2dabcd9015cf598d678dfa38b427d17cd6e461b750c4042a5ded62fd37d340d2f8b4f4d29ce52fef2f57342732fa198f42cc07ef35f15586304
SSDEEP 24576:bU5Mh3c6qHClooCZ9Eo7rYwZpV8yZa0C+8AvrNwRgyFM3VIH06iyz:bUiG6qgorb77rYw1ZBCOIgMYIU6i
TLSH
T142957C03E69584FAC49DC078C3579536BA32BC8D0B34B2EB2BD49A213E26F906F1D755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3700	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4324	cryptolock_test.exe
4324	cryptolock_test.exe
4324	cryptolock_test.exe
4324	cryptolock_test.exe
4324	cryptolock_test.exe
4324	cryptolock_test.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3700	4324	cryptolock_test.exe	90
PID 3700 wrote to memory of 5432	3700	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\cryptolock_test.exe
"C:\Users\Admin\AppData\Local\Temp\cryptolock_test.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /C start notepad.exe cryptolock_test_report.txt
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\notepad.exe
    notepad.exe cryptolock_test_report.txt
    3⤵
    PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cryptolock_test_report.txt

Path C:\Users\Admin\AppData\Local\Temp\cryptolock_test_report.txt
Size 9KB
SHA256 2f975995f0d6037176eecf60f1f3a22e000e2189189434464742fa88fbaf94e7
MD5 4162fdf764e241ce649ad6c0dcc80dae
SHA1 5a00c9ca1085c130706e6cbe49a49975e029072a
SHA512 725c623e93296d4b54375dda2ed344532674b4c47573ff7d6565f83644fd520a5916efb8452c858c5e227be1c8b19ecbe09b635ac369d6ee6afc4a7ce5ca199c
SSDEEP 192:g/B1mmaV9syV47/JWeeczyVgtdMVPLV5/2Cfr7wvZO6BQNk9GSKuAIbDytyMevmR:g/B1xaV6yV4TJWeeczyVgtdMVPLV5/20
TLSH
T1C212B711AC79BCB6EF46A028F2773F185722EA47B0C12D507BC454C5EF62C484E9ADA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download