Overview

overview

10

Static

static

3

2024-03-19...ck.exe

windows7-x64

10

2024-03-19...ck.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 20:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-19_f138f1b9284d19e9536aae3c1b6e6dd7_virlock.exe

  • Size

    174KB

  • MD5

    f138f1b9284d19e9536aae3c1b6e6dd7

  • SHA1

    cad0cca879ce6dd548b55bcab3a870745bc54249

  • SHA256

    4e0229c8186d34f6a1c43df033a21090bd1a658215fa9aca7393f9f5f5037e39

  • SHA512

    c25e3c5142654bb659b2ec92ab6d7d664a8f249349037a5310efbf192abed7f2ad18af5c54789480576207d0859ddcba2877873dce3d7739a918fc5dfe0f8ceb

  • SSDEEP

    3072:P20vP29Evh/SfNHUS9cDEXsf2fAGCe1PrLHB0Hf+0NzenliaTNdwsyMPKMKnLkcK:PSEvh/+NHUCcDEXsf2flPdh0Hf+KinkU

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-19_f138f1b9284d19e9536aae3c1b6e6dd7_virlock.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-19_f138f1b9284d19e9536aae3c1b6e6dd7_virlock.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\CiUwIosc\jCEoEUwc.exe
      "C:\Users\Admin\CiUwIosc\jCEoEUwc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:3592
    • C:\ProgramData\ciMoMkEU\oqEUgcwA.exe
      "C:\ProgramData\ciMoMkEU\oqEUgcwA.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4952
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Bginfo64.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Users\Admin\AppData\Local\Temp\Bginfo64.exe
        C:\Users\Admin\AppData\Local\Temp\Bginfo64.exe
        3⤵
        • Executes dropped EXE
        PID:2728
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies registry key
      PID:3556
    • C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      2⤵
      • Modifies registry key
      PID:1752
    • C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      2⤵
      • UAC bypass
      • Modifies registry key
      PID:3648
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4056

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Modify Registry

          4
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
            Filesize

            579KB

            MD5

            756b81c482030c1fa7500a08ba561b4d

            SHA1

            b5d2b00cf817f4bd3aaef4531addb15ddb1c5b4c

            SHA256

            1820f7d2d9d6d5c7dfedb58f052171057ed8763f7b1f20ee5e9ed31e233844d5

            SHA512

            d845a5d91b522083a7fe98478a179a10fab6aa9c4e6b3e73cf1be10cfe06bc1d58e31fe393247fe81ab2a22b0f2e6d0700d60bbaa1fc603849dafe4ffdbcb4e4

            Download Submit

          • C:\ProgramData\ciMoMkEU\oqEUgcwA.exe
            Filesize

            127KB

            MD5

            4f469a9c250f18f1b1aed6288f4aa30e

            SHA1

            84cfd09166059d4bff932e81e9649d2066c1219a

            SHA256

            3449136a7ac4d9578e394ce2548430f7b1c313e270bfb9d995f8ad4eb85695a2

            SHA512

            6614f7fb39056611288145594188cf61359457ddd2fe945bf366b8b7b40b22b1aa8f52678ddf6fcee7b48a1ed8315e403f4c5897098d06aeb139b9f048190bcc

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Bginfo64.exe
            Filesize

            24KB

            MD5

            c6b3c81dff28dce882ba4f9f1d428423

            SHA1

            2d31bae0b83b12511a49a81938fd350e5c687331

            SHA256

            9e09478d6a518fd99520c36cadf415d34c52efc444dfc8bb8edbf92af66ca788

            SHA512

            fa19706c17659976402380ee2852470092272300366d677d6ddf66713627e5619ef32614f35f75f02475c99777da1e691a3c538b01bcd329177fa251b0f838a6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\lUAW.exe
            Filesize

            5.2MB

            MD5

            74727004472eb3c62b7caf1d6939b59f

            SHA1

            7967bd6383e6b9ee6ce94871aa4a92f820bf26be

            SHA256

            26eca636dfe421cb37fda859cbbed73de297875832bf1aafcadf5a2f2b356103

            SHA512

            846488a3370c46ef74d3007da893881bf2a33ebf68af4efb1ad8ddb35d28323ddfead8ea8c5c457cb1afbb096121b77845fb0c740f2e811a2da3d10897a4314f

            Download Submit

          • C:\Users\Admin\CiUwIosc\jCEoEUwc.exe
            Filesize

            131KB

            MD5

            6dc77e0bb1c2709e39e8e387cb829e7d

            SHA1

            635377211ef31b90d6d7107d9f591216a8777c59

            SHA256

            b5560bba1766fe7ca1409050ae996322bbb28eac9d92fce6f7a0fcfdfce79253

            SHA512

            21e5125f8d89947041bf478b12121a8a7b49901afbfb482bd459e5b0d8bedabf0e7b3b5440434645c140670314e270dfa157ce4e775cbe0a7237245fc06397a6

            Download Submit

          • memory/2484-0-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/2484-17-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

            Download

          • memory/2728-21-0x0000000000610000-0x000000000061C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/2728-23-0x00007FFE92B10000-0x00007FFE935D1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2728-39-0x00007FFE92B10000-0x00007FFE935D1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3592-6-0x0000000000400000-0x0000000000422000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4952-14-0x0000000000400000-0x0000000000421000-memory.dmp

            Filesize

            132KB

            Download