Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-10-16_8407fc3b6183cec64939631e05806d11_virlock

  • Size

    200KB

  • Sample

    241016-g7sw8axard

  • MD5

    8407fc3b6183cec64939631e05806d11

  • SHA1

    5f347b2d6b3b4ba8a5c06a98897e58e67152a54a

  • SHA256

    19c60c87f1c3e44b76b8e4230a970f8376727f992834368a3cd152d109e90c20

  • SHA512

    b8512ec93db92fd7696a5721f448be2a9446862ecb19281759ac78f524de5e1972f18a6ee4442a1635e2b3dc3be4bfc80e50672e6910edcb4be39f22fcd2093b

  • SSDEEP

    3072:/er5BVRiWes1Z7wwK0heFa4kclsl5e1DLmF9I0LNtJV:/eXiuMwK0heUcel5ADLa9Ig

Malware Config

Targets

    • Target

      2024-10-16_8407fc3b6183cec64939631e05806d11_virlock

    • Size

      200KB

    • MD5

      8407fc3b6183cec64939631e05806d11

    • SHA1

      5f347b2d6b3b4ba8a5c06a98897e58e67152a54a

    • SHA256

      19c60c87f1c3e44b76b8e4230a970f8376727f992834368a3cd152d109e90c20

    • SHA512

      b8512ec93db92fd7696a5721f448be2a9446862ecb19281759ac78f524de5e1972f18a6ee4442a1635e2b3dc3be4bfc80e50672e6910edcb4be39f22fcd2093b

    • SSDEEP

      3072:/er5BVRiWes1Z7wwK0heFa4kclsl5e1DLmF9I0LNtJV:/eXiuMwK0heUcel5ADLa9Ig

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (56) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks