Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-10-25_2d6aaa1b3c1dd4a05cd6d5b204830c87_virlock

  • Size

    1.0MB

  • Sample

    241025-y9e7ksskbw

  • MD5

    2d6aaa1b3c1dd4a05cd6d5b204830c87

  • SHA1

    bd9ef8d7677da4579d8612a06097d96d29b15d12

  • SHA256

    5bb366ecb79205330b6bb1ab30a8692bcfcfdde9280b8cb412141d2efb59e715

  • SHA512

    3d33703f3646f59b7e25330010fc886fb5fd67e28e42d57f484612bea8239723f09e5747184ac66938c4432576877096ec8dde772f2276c0b518e829e71170b6

  • SSDEEP

    24576:qeZtjSABFCZOCfUUkvuyJj6ztk8NPYXIbaHKJqFlFZ8:fjSmC7cUkvJMYQJqM

Malware Config

Targets

    • Target

      2024-10-25_2d6aaa1b3c1dd4a05cd6d5b204830c87_virlock

    • Size

      1.0MB

    • MD5

      2d6aaa1b3c1dd4a05cd6d5b204830c87

    • SHA1

      bd9ef8d7677da4579d8612a06097d96d29b15d12

    • SHA256

      5bb366ecb79205330b6bb1ab30a8692bcfcfdde9280b8cb412141d2efb59e715

    • SHA512

      3d33703f3646f59b7e25330010fc886fb5fd67e28e42d57f484612bea8239723f09e5747184ac66938c4432576877096ec8dde772f2276c0b518e829e71170b6

    • SSDEEP

      24576:qeZtjSABFCZOCfUUkvuyJj6ztk8NPYXIbaHKJqFlFZ8:fjSmC7cUkvJMYQJqM

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (80) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks