Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 21:33

General

  • Target

    ViraLock.exe

  • Size

    194KB

  • MD5

    8803d517ac24b157431d8a462302b400

  • SHA1

    b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e

  • SHA256

    418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786

  • SHA512

    38fdfe0bc873e546b05a8680335526eec61ccc8cf3f37c60eee0bc83ec54570077f1dc1da26142488930eabcc21cb7a33c1b545a194cbfb4c87e430c4b2bfb50

  • SSDEEP

    3072:slkfrcHVaq65Oe/ALwm19MYDzMLGquSOt+nSmgevSvoWAnvN0bfINcfln8rvK:Wkfrc0q47/UwQFSFnH9SArvakSflnCS

Score
1/10

Malware Config

Signatures

  • Modifies registry key 1 TTPs 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
    "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe"
    1⤵
      PID:4780
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
        2⤵
          PID:768
      • C:\Windows\SysWOW64\cscript.exe
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        1⤵
          PID:1268
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
          1⤵
            PID:1548
            • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
              C:\Users\Admin\AppData\Local\Temp\ViraLock
              2⤵
                PID:3592
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
              1⤵
              • Modifies registry key
              PID:4248
            • C:\Windows\SysWOW64\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
              1⤵
              • Modifies registry key
              PID:2044
            • C:\Windows\SysWOW64\reg.exe
              reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
              1⤵
              • Modifies registry key
              PID:812
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\keggsYoQ.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
              1⤵
                PID:2732
                • C:\Windows\SysWOW64\cscript.exe
                  cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                  2⤵
                    PID:3960
                • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                  C:\Users\Admin\AppData\Local\Temp\ViraLock
                  1⤵
                    PID:4216
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                      2⤵
                        PID:3156
                        • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                          C:\Users\Admin\AppData\Local\Temp\ViraLock
                          3⤵
                            PID:2480
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                          2⤵
                          • Modifies registry key
                          PID:4984
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                          2⤵
                          • Modifies registry key
                          PID:3936
                        • C:\Windows\SysWOW64\reg.exe
                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                          2⤵
                          • Modifies registry key
                          PID:1204
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jCYQkgAM.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                          2⤵
                            PID:4184
                        • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                          C:\Users\Admin\AppData\Local\Temp\ViraLock
                          1⤵
                            PID:4048
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                              2⤵
                                PID:2300
                                • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                                  C:\Users\Admin\AppData\Local\Temp\ViraLock
                                  3⤵
                                    PID:1508
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                      4⤵
                                        PID:216
                                        • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                                          C:\Users\Admin\AppData\Local\Temp\ViraLock
                                          5⤵
                                            PID:3500
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                              6⤵
                                                PID:1696
                                                • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                                                  C:\Users\Admin\AppData\Local\Temp\ViraLock
                                                  7⤵
                                                    PID:1840
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                                      8⤵
                                                        PID:4588
                                                        • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                                                          C:\Users\Admin\AppData\Local\Temp\ViraLock
                                                          9⤵
                                                            PID:3472
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                                              10⤵
                                                                PID:3300
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                10⤵
                                                                • Modifies registry key
                                                                PID:2500
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                10⤵
                                                                • Modifies registry key
                                                                PID:2288
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                10⤵
                                                                • Modifies registry key
                                                                PID:4600
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bUkEQMgg.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                                                                10⤵
                                                                  PID:3492
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    11⤵
                                                                      PID:4936
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                8⤵
                                                                • Modifies registry key
                                                                PID:4932
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                8⤵
                                                                • Modifies registry key
                                                                PID:4884
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                8⤵
                                                                • Modifies registry key
                                                                PID:4800
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwIQAIok.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                                                                8⤵
                                                                  PID:3284
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    9⤵
                                                                      PID:552
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                6⤵
                                                                • Modifies registry key
                                                                PID:3488
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                6⤵
                                                                • Modifies registry key
                                                                PID:4516
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                6⤵
                                                                • Modifies registry key
                                                                PID:1364
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ecYYkIgw.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                                                                6⤵
                                                                  PID:728
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    7⤵
                                                                      PID:4744
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                                4⤵
                                                                • Modifies registry key
                                                                PID:4460
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                                4⤵
                                                                • Modifies registry key
                                                                PID:1128
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                                4⤵
                                                                • Modifies registry key
                                                                PID:1452
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omkEUwcg.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                                                                4⤵
                                                                  PID:2524
                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                    5⤵
                                                                      PID:1700
                                                            • C:\Windows\SysWOW64\cscript.exe
                                                              cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                              1⤵
                                                                PID:444
                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                1⤵
                                                                  PID:4484
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                                                  1⤵
                                                                    PID:2372
                                                                    • C:\Users\Admin\AppData\Local\Temp\ViraLock.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\ViraLock
                                                                      2⤵
                                                                        PID:1244
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"
                                                                          3⤵
                                                                            PID:460
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TyAAYMEc.bat" "C:\Users\Admin\AppData\Local\Temp\ViraLock.exe""
                                                                        1⤵
                                                                          PID:4084
                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                            cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
                                                                            2⤵
                                                                              PID:4476

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Temp\EEcAYkow.bat

                                                                            Filesize

                                                                            112B

                                                                            MD5

                                                                            bae1095f340720d965898063fede1273

                                                                            SHA1

                                                                            455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                                            SHA256

                                                                            ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                                            SHA512

                                                                            4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                                          • C:\Users\Admin\AppData\Local\Temp\ViraLock

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            76e08b93985d60b82ddb4a313733345c

                                                                            SHA1

                                                                            273effbac9e1dc901a3f0ee43122d2bdb383adbf

                                                                            SHA256

                                                                            4dc0a8afbf4dbb1a67b9292bb028b7f744f3029b0083c36307b1f84a00692a89

                                                                            SHA512

                                                                            4226266b623d502f9b0901355ff388e1fc705e9baff0cbe49a52ef59578e1cc66f5026c030df4c8a8f5000b743523ccf18c533aee269b562d3017d14af014f9d

                                                                          • C:\Users\Admin\AppData\Local\Temp\file.vbs

                                                                            Filesize

                                                                            19B

                                                                            MD5

                                                                            4afb5c4527091738faf9cd4addf9d34e

                                                                            SHA1

                                                                            170ba9d866894c1b109b62649b1893eb90350459

                                                                            SHA256

                                                                            59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

                                                                            SHA512

                                                                            16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

                                                                          • memory/1244-165-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/1508-119-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/1768-169-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/1840-145-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/1840-128-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/2112-55-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/2480-95-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3472-157-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3472-141-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3500-115-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3500-133-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3592-46-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/3592-30-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4048-91-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4048-107-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4216-83-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4216-66-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4476-34-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4476-16-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4524-42-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4524-58-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4780-0-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/4780-20-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                            Filesize

                                                                            200KB

                                                                          • memory/5112-15-0x0000000000400000-0x0000000000433000-memory.dmp

                                                                            Filesize

                                                                            204KB