Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 21:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe
-
Size
198KB
-
MD5
019e858aa9c2360d2b5671c9ec522503
-
SHA1
318efd5e08114ea7b0b666a26bb220876970ca36
-
SHA256
b362898f4efb5f5ccd44709a3aa13213096ef2070254f483708691825ceefe10
-
SHA512
29c08c623e51568196a91ad44470b8657fb69eaccc581326c6b1f694e9b1dc0095802472ca5f4116fa8c7b380ecef7d95d2d4ce50b1b7fcd4442387f90993d31
-
SSDEEP
3072:j7o79PB/c8nsC97EW+qu68IQPb6fXIFkYjj+jUaR64uBdj8K3LEmtSj45:jyPFQsX+d6GDHjj+jYBdIKb3tyk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2656 4376 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_019e858aa9c2360d2b5671c9ec522503_virlock.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2242⤵
- Program crash
PID:2656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4376 -ip 43761⤵PID:984