General
-
Target
2024-11-20_92f7d5f7ac3f057a1327549922c438b5_virlock
-
Size
110KB
-
Sample
241120-qpkbssxhjq
-
MD5
92f7d5f7ac3f057a1327549922c438b5
-
SHA1
7121142f80d0abfccf9a99f6d3e4fa071a760075
-
SHA256
38f8ab30ad8b455fb43a8ac3f067270df8a694aa25a1a3f1fe1b25e0175ac99a
-
SHA512
05bd1c7241a0594cb069ea63bac206c181516b5efbd137cc1f7101521fc6ec8989997993edd2ad97ecacc654e6cf2406b872ce0f459b5bf147e535b4da91186e
-
SSDEEP
3072:4yn7YTtqpeACe2whxxQHmOVM8kfebUb/7BXmMP:4OYTtqJCBIxQHmOVwfeS7BW4
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-20_92f7d5f7ac3f057a1327549922c438b5_virlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-20_92f7d5f7ac3f057a1327549922c438b5_virlock.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2024-11-20_92f7d5f7ac3f057a1327549922c438b5_virlock
-
Size
110KB
-
MD5
92f7d5f7ac3f057a1327549922c438b5
-
SHA1
7121142f80d0abfccf9a99f6d3e4fa071a760075
-
SHA256
38f8ab30ad8b455fb43a8ac3f067270df8a694aa25a1a3f1fe1b25e0175ac99a
-
SHA512
05bd1c7241a0594cb069ea63bac206c181516b5efbd137cc1f7101521fc6ec8989997993edd2ad97ecacc654e6cf2406b872ce0f459b5bf147e535b4da91186e
-
SSDEEP
3072:4yn7YTtqpeACe2whxxQHmOVM8kfebUb/7BXmMP:4OYTtqJCBIxQHmOVwfeS7BW4
-
Modifies visibility of file extensions in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1