Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-10-25_14dd0fb573930f057425c8901d47ac51_virlock

  • Size

    746KB

  • Sample

    241025-y7wrjsthrb

  • MD5

    14dd0fb573930f057425c8901d47ac51

  • SHA1

    a70dab48ac5c714b05b05630a96a34c3539a06e0

  • SHA256

    bb75e6d3d9cab1dc21620c16ea756456653ca7aa2b74425863b16892563584dc

  • SHA512

    38a73dfae62babc9fcbbf768866ce605b837e4e8b1b4c86b24b571eef8d5eae26d748869a0aa25a34612fcdbf6725406a63719c8045966eec0c89abcd63e775e

  • SSDEEP

    12288:9bhjnHgIx9JNYi7A/+r2L7W3PJXqMwxI6YnJd9ZftnFq32UZTK8o:9BHge9JNYVe3P9n1JlftnFZkE

Malware Config

Targets

    • Target

      2024-10-25_14dd0fb573930f057425c8901d47ac51_virlock

    • Size

      746KB

    • MD5

      14dd0fb573930f057425c8901d47ac51

    • SHA1

      a70dab48ac5c714b05b05630a96a34c3539a06e0

    • SHA256

      bb75e6d3d9cab1dc21620c16ea756456653ca7aa2b74425863b16892563584dc

    • SHA512

      38a73dfae62babc9fcbbf768866ce605b837e4e8b1b4c86b24b571eef8d5eae26d748869a0aa25a34612fcdbf6725406a63719c8045966eec0c89abcd63e775e

    • SSDEEP

      12288:9bhjnHgIx9JNYi7A/+r2L7W3PJXqMwxI6YnJd9ZftnFq32UZTK8o:9BHge9JNYVe3P9n1JlftnFZkE

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (83) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks