f4b55075c40877a18d983ec2651f0ee290f4dbeaeb77963d1a2c0c1b687a1293 | Triage

Sharing

General

Target

2024-09-07_e0f553c2dfe03842c9e694108a1764ec_virlock
Size

206KB
Sample

240907-nv5tksseqr
MD5

e0f553c2dfe03842c9e694108a1764ec
SHA1

a42656d4d3e4aa169c847df8a522c9f91edf7886
SHA256

f4b55075c40877a18d983ec2651f0ee290f4dbeaeb77963d1a2c0c1b687a1293
SHA512

857610e165990f75a28450ed4795e95bf1938a93eb7b96e741e5e0e7af410690d6683f4c3fd83110007aa79f9092dc3d8feed5062f142a975f243480ebb47f06
SSDEEP

3072:lB0dtuStHcVIPaUP4YFclhW9NCRg8WUzf+YBcOSbNLO5mvfLYpMGrmXW:lqd3qVIdnCRh7+YlSxhvTYI

Score

10^/10

discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Targets

- Target
  
  2024-09-07_e0f553c2dfe03842c9e694108a1764ec_virlock
- Size
  
  206KB
- MD5
  
  e0f553c2dfe03842c9e694108a1764ec
- SHA1
  
  a42656d4d3e4aa169c847df8a522c9f91edf7886
- SHA256
  
  f4b55075c40877a18d983ec2651f0ee290f4dbeaeb77963d1a2c0c1b687a1293
- SHA512
  
  857610e165990f75a28450ed4795e95bf1938a93eb7b96e741e5e0e7af410690d6683f4c3fd83110007aa79f9092dc3d8feed5062f142a975f243480ebb47f06
- SSDEEP
  
  3072:lB0dtuStHcVIPaUP4YFclhW9NCRg8WUzf+YBcOSbNLO5mvfLYpMGrmXW:lqd3qVIdnCRh7+YlSxhvTYI
Score

10^/10

discovery evasion persistence ransomware spyware stealer trojan
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Renames multiple (57) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwarespywarestealertrojan

behavioral2

discoveryevasionpersistenceransomwarespywarestealertrojan