Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/10/2024, 06:32
General
- Target 2024-10-06_df6880ab807ea16c3535ed77ba2a0962_virlock.exe
- Size 254KB
- Sample241006-hat9fsvblk
- SHA256 d7d1b9d40367112eb66e1912cc652f321416c616e73f6c59e3b91ef8ed8388fd
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-06_df6880ab807ea16c3535ed77ba2a0962_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-06_df6880ab807ea16c3535ed77ba2a0962_virlock.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\tqkIskkE\Amwggwcs.exe"C:\Users\Admin\tqkIskkE\Amwggwcs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\aeQEQkMY\fCQMAsAA.exe"C:\ProgramData\aeQEQkMY\fCQMAsAA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\clist.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\clist.exeC:\Users\Admin\AppData\Local\Temp\clist.exe3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
background.png.exe
device.png.exe
overlay.png.exe
background.png.exe
watermark.png.exe
guest.bmp.exe
user-32.png.exe
user-40.png.exe
user.bmp.exe
vcredist_x86.exe
VC_redist.x86.exe
VC_redist.x64.exe
fCQMAsAA.exe
AppErrorWhite.png.exe
Error.png.exe
QuotaError.png.exe
QuotaNearing.png.exe
ScreenshotOptIn.gif.exe
blurrect.png.exe
OneDriveMedTile.contrast-white_scale-400.png.exe
OneDriveMedTile.scale-125.png.exe
OneDriveMedTile.scale-150.png.exe
OneDriveMedTile.scale-200.png.exe
OneDriveSmallTile.contrast-black_scale-100.png.exe
OneDriveSmallTile.contrast-black_scale-400.png.exe
OneDriveSmallTile.contrast-white_scale-100.png.exe
OneDriveSmallTile.scale-150.png.exe
OneDriveSmallTile.scale-400.png.exe
Akwg.exe
AoQY.exe
CAci.exe
Coca.exe
Csow.exe
CwoS.exe
EwMm.exe
EwkG.exe
GUYc.exe
GYga.exe
IYsC.exe
IwUQ.exe
KMwO.exe
KUUW.exe
KcQs.exe
Kksu.exe
KoAW.exe
MEMC.exe
McMU.exe
OAYy.exe
OEkM.exe
OEwO.exe
OMgm.exe
OgQg.exe
OsIA.exe
Osgk.exe
OwYU.exe
QYMm.exe
ScMy.exe
SsAI.exe
UMQO.exe
UMko.exe
UQkE.exe
UQwi.exe
UUAG.exe
UYwk.exe
UckM.exe
UsEG.exe
WAsk.exe
WoYa.exe
YIcG.ico
YMAc.exe
YMkC.exe
YYUA.exe
YsAA.exe
YwoK.exe
aAwW.exe
aIIY.exe
aQgk.exe
ccYw.exe
ckIK.exe
clist.exe
eMoK.exe
eYAy.exe
gEsi.exe
kEAM.exe
kIYg.exe
kIwQ.exe
mIIM.exe
mkUm.exe
mwoU.exe
oAki.exe
oMIM.exe
ocQE.exe
ogIQ.exe
osAw.exe
qIIi.ico
qIwG.exe
qYIi.exe
qcsg.ico
qwEw.exe
sEUi.exe
sIcs.exe
sIkG.ico
uIko.exe
ucIa.exe
wUQm.exe
wcoG.exe
woAk.exe
wowA.exe
yYQK.exe
UnregisterWatch.png.exe
ReadComplete.mp3.exe
Amwggwcs.exe
memory/2192-19-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2192-0-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3324-21-0x0000000000C30000-0x0000000000C58000-memory.dmp
memory/4752-15-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4752-1542-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4840-7-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4840-1541-0x0000000000400000-0x000000000041D000-memory.dmp