Overview

overview

10

Static

static

2022-11-23...ck.exe

windows7-x64

10

2022-11-23...ck.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2022-11-23_fe04426caaf094ed341ccc1657e64ae3_virlock

  • Size

    2.3MB

  • Sample

    221123-xaprased64

  • MD5

    fe04426caaf094ed341ccc1657e64ae3

  • SHA1

    d1a4ee9243b09c32b52c90d7ee887d5ecacbdd19

  • SHA256

    d3e00146f485478786404bbace60071b9add4db24714a24696bb24576e6e952c

  • SHA512

    077c686419e856e7972936221900374e089b54ee91d9d97b5b85a1657e33b3882b996ceb561f082d36f6788f1086fa60dc5ccc8abe8c1110da9c2ec838835572

  • SSDEEP

    24576:ApeV0t19s+nurr5d7oQUEZZ9ZEB7pZsUcgQqudlaoSJ8XfgR7Gf6A3Lsnjl6/KHo:A0QUdhNoQLrElcRvlaoPoNAyjlRHGP

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      2022-11-23_fe04426caaf094ed341ccc1657e64ae3_virlock

    • Size

      2.3MB

    • MD5

      fe04426caaf094ed341ccc1657e64ae3

    • SHA1

      d1a4ee9243b09c32b52c90d7ee887d5ecacbdd19

    • SHA256

      d3e00146f485478786404bbace60071b9add4db24714a24696bb24576e6e952c

    • SHA512

      077c686419e856e7972936221900374e089b54ee91d9d97b5b85a1657e33b3882b996ceb561f082d36f6788f1086fa60dc5ccc8abe8c1110da9c2ec838835572

    • SSDEEP

      24576:ApeV0t19s+nurr5d7oQUEZZ9ZEB7pZsUcgQqudlaoSJ8XfgR7Gf6A3Lsnjl6/KHo:A0QUdhNoQLrElcRvlaoPoNAyjlRHGP

    Score
    10/10
    persistenceevasiontrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

5
T1112

Hidden Files and Directories

1
T1158

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks