Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2024-06-07_dd098dc2c3a37fa89e0cd3eddce6c1f4_virlock
-
Size
831KB
-
Sample
240607-p6mb2shd86
-
MD5
dd098dc2c3a37fa89e0cd3eddce6c1f4
-
SHA1
d39b31f870c8bda39a10b40a645f275bc87c33ae
-
SHA256
504418eb2a4969311d7cd9bcc835543dc004e29f2ad5d60fbbec3c679260cd45
-
SHA512
a20d4ead5fa2f2361c37b8abb512e366f4ce763f0f9ed33fb04634945a3962e2a729f34ba5ed847d2ee33d3bfad332cb93754861fdefe93e6af9fa9f652972cd
-
SSDEEP
12288:sG0JUO8gFzRUQDZfqqo/xZ0kIhRU/yND76kbTosloyWbItwcbZ1guX7r46F:0JUO8glhsDfmGUobItw4ZXpF
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-07_dd098dc2c3a37fa89e0cd3eddce6c1f4_virlock.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-07_dd098dc2c3a37fa89e0cd3eddce6c1f4_virlock.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
2024-06-07_dd098dc2c3a37fa89e0cd3eddce6c1f4_virlock
-
Size
831KB
-
MD5
dd098dc2c3a37fa89e0cd3eddce6c1f4
-
SHA1
d39b31f870c8bda39a10b40a645f275bc87c33ae
-
SHA256
504418eb2a4969311d7cd9bcc835543dc004e29f2ad5d60fbbec3c679260cd45
-
SHA512
a20d4ead5fa2f2361c37b8abb512e366f4ce763f0f9ed33fb04634945a3962e2a729f34ba5ed847d2ee33d3bfad332cb93754861fdefe93e6af9fa9f652972cd
-
SSDEEP
12288:sG0JUO8gFzRUQDZfqqo/xZ0kIhRU/yND76kbTosloyWbItwcbZ1guX7r46F:0JUO8glhsDfmGUobItw4ZXpF
-
Modifies visibility of file extensions in Explorer
-
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1