Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-10-25_d018080d98ec3433f7e4b80d6f8af9e6_virlock

  • Size

    332KB

  • Sample

    241025-zlk9cs1rhk

  • MD5

    d018080d98ec3433f7e4b80d6f8af9e6

  • SHA1

    51cb51b570bb3fc90a36eb37f596e2e398e7dde8

  • SHA256

    5cdfe8cdda9df8b2b736a54660e33c5cea38d8ef22d3d7126043aedfa67d9916

  • SHA512

    407fd6cac4572445d83ab516eabc9465a569fc71c7b56ce2be1e605151eaface6235c651c2e838979b7933848e8934d830735bd1aae0fc6a11275a66d711e5c6

  • SSDEEP

    6144:tgfqT6CeuQnYqr8fW7lQZBDj24WOidZDlOldFms1IBo0si4IlL0osnyXk+s/CTs:tUjuQYqYfWENW4lLmRsyVk+9

Malware Config

Targets

    • Target

      2024-10-25_d018080d98ec3433f7e4b80d6f8af9e6_virlock

    • Size

      332KB

    • MD5

      d018080d98ec3433f7e4b80d6f8af9e6

    • SHA1

      51cb51b570bb3fc90a36eb37f596e2e398e7dde8

    • SHA256

      5cdfe8cdda9df8b2b736a54660e33c5cea38d8ef22d3d7126043aedfa67d9916

    • SHA512

      407fd6cac4572445d83ab516eabc9465a569fc71c7b56ce2be1e605151eaface6235c651c2e838979b7933848e8934d830735bd1aae0fc6a11275a66d711e5c6

    • SSDEEP

      6144:tgfqT6CeuQnYqr8fW7lQZBDj24WOidZDlOldFms1IBo0si4IlL0osnyXk+s/CTs:tUjuQYqYfWENW4lLmRsyVk+9

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (79) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks