Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe
-
Size
930KB
-
MD5
fd1be1572ed245d5e2eb8afafe803451
-
SHA1
b1dd2828c4b0f834fc6665cb26bbe60dab3fe42a
-
SHA256
27b263ebe05c7041de444d6746fcc79dbae774644dde22b6cbfe43bc8ac30a55
-
SHA512
b8795b2c95b45eee1e532a486c433aee25675b4f1dcbee09faa658eaf534f6889115a76cac14f3f1d5b7ba646aac390880b69a11012a22bc351b19630da60b5a
-
SSDEEP
24576:QcSGmlVcNLJMSGw8p5tOF8KOc+YsVgrz:QRGm7cNLVGzgF8zl2
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Executes dropped EXE 2 IoCs
pid Process 4940 FUAQMMkQ.exe 4168 NwssMoIE.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FUAQMMkQ.exe = "C:\\Users\\Admin\\KoAgYYUE\\FUAQMMkQ.exe" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NwssMoIE.exe = "C:\\ProgramData\\asosoccg\\NwssMoIE.exe" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FUAQMMkQ.exe = "C:\\Users\\Admin\\KoAgYYUE\\FUAQMMkQ.exe" FUAQMMkQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NwssMoIE.exe = "C:\\ProgramData\\asosoccg\\NwssMoIE.exe" NwssMoIE.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe FUAQMMkQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe FUAQMMkQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 2212 reg.exe 1644 reg.exe 1516 reg.exe 3916 reg.exe 4192 reg.exe 3960 reg.exe 1144 reg.exe 208 reg.exe 3724 reg.exe 2904 Process not Found 1364 reg.exe 2312 reg.exe 3348 reg.exe 3452 reg.exe 2716 reg.exe 3028 reg.exe 3260 reg.exe 2192 reg.exe 828 reg.exe 3576 reg.exe 488 reg.exe 2456 reg.exe 1876 reg.exe 1652 reg.exe 116 reg.exe 3460 reg.exe 4288 reg.exe 3944 reg.exe 3128 reg.exe 1368 reg.exe 4836 reg.exe 4624 reg.exe 4364 reg.exe 2456 reg.exe 1300 Process not Found 1644 reg.exe 3664 reg.exe 2060 reg.exe 4556 reg.exe 1296 reg.exe 2620 reg.exe 4740 reg.exe 1036 reg.exe 4376 reg.exe 4724 reg.exe 4328 reg.exe 3656 reg.exe 4304 reg.exe 4384 reg.exe 4788 reg.exe 4288 reg.exe 2984 reg.exe 4216 reg.exe 3848 reg.exe 4364 reg.exe 3140 reg.exe 1536 reg.exe 1308 reg.exe 4428 reg.exe 3820 reg.exe 3244 reg.exe 2704 reg.exe 4184 reg.exe 4736 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3740 reg.exe 3740 reg.exe 3740 reg.exe 3740 reg.exe 1488 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1488 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1488 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1488 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4704 Conhost.exe 4704 Conhost.exe 4704 Conhost.exe 4704 Conhost.exe 1640 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1640 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1640 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1640 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 2508 Conhost.exe 2508 Conhost.exe 2508 Conhost.exe 2508 Conhost.exe 3016 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3016 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3016 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3016 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1452 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1452 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1452 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 1452 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 868 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 868 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 868 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 868 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 2908 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 2908 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 2908 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 2908 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 5096 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 5096 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 5096 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 5096 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3820 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3820 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3820 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3820 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3896 Conhost.exe 3896 Conhost.exe 3896 Conhost.exe 3896 Conhost.exe 3152 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3152 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3152 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 3152 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 4936 reg.exe 4936 reg.exe 4936 reg.exe 4936 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4940 FUAQMMkQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe 4940 FUAQMMkQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4940 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 81 PID 4408 wrote to memory of 4940 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 81 PID 4408 wrote to memory of 4940 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 81 PID 4408 wrote to memory of 4168 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 82 PID 4408 wrote to memory of 4168 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 82 PID 4408 wrote to memory of 4168 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 82 PID 4408 wrote to memory of 4336 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 83 PID 4408 wrote to memory of 4336 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 83 PID 4408 wrote to memory of 4336 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 83 PID 4408 wrote to memory of 1308 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 85 PID 4408 wrote to memory of 1308 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 85 PID 4408 wrote to memory of 1308 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 85 PID 4408 wrote to memory of 3452 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 91 PID 4408 wrote to memory of 3452 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 91 PID 4408 wrote to memory of 3452 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 91 PID 4408 wrote to memory of 3696 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 88 PID 4408 wrote to memory of 3696 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 88 PID 4408 wrote to memory of 3696 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 88 PID 4408 wrote to memory of 1508 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 87 PID 4408 wrote to memory of 1508 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 87 PID 4408 wrote to memory of 1508 4408 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 87 PID 4336 wrote to memory of 4728 4336 cmd.exe 93 PID 4336 wrote to memory of 4728 4336 cmd.exe 93 PID 4336 wrote to memory of 4728 4336 cmd.exe 93 PID 1508 wrote to memory of 1928 1508 cmd.exe 94 PID 1508 wrote to memory of 1928 1508 cmd.exe 94 PID 1508 wrote to memory of 1928 1508 cmd.exe 94 PID 4728 wrote to memory of 4844 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 95 PID 4728 wrote to memory of 4844 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 95 PID 4728 wrote to memory of 4844 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 95 PID 4728 wrote to memory of 2108 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 97 PID 4728 wrote to memory of 2108 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 97 PID 4728 wrote to memory of 2108 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 97 PID 4728 wrote to memory of 1296 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 101 PID 4728 wrote to memory of 1296 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 101 PID 4728 wrote to memory of 1296 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 101 PID 4728 wrote to memory of 4880 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 99 PID 4728 wrote to memory of 4880 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 99 PID 4728 wrote to memory of 4880 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 99 PID 4728 wrote to memory of 4720 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 98 PID 4728 wrote to memory of 4720 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 98 PID 4728 wrote to memory of 4720 4728 fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe 98 PID 4844 wrote to memory of 3740 4844 cmd.exe 174 PID 4844 wrote to memory of 3740 4844 cmd.exe 174 PID 4844 wrote to memory of 3740 4844 cmd.exe 174 PID 4720 wrote to memory of 116 4720 cmd.exe 106 PID 4720 wrote to memory of 116 4720 cmd.exe 106 PID 4720 wrote to memory of 116 4720 cmd.exe 106 PID 3740 wrote to memory of 1988 3740 reg.exe 107 PID 3740 wrote to memory of 1988 3740 reg.exe 107 PID 3740 wrote to memory of 1988 3740 reg.exe 107 PID 3740 wrote to memory of 4080 3740 reg.exe 110 PID 3740 wrote to memory of 4080 3740 reg.exe 110 PID 3740 wrote to memory of 4080 3740 reg.exe 110 PID 3740 wrote to memory of 2364 3740 reg.exe 117 PID 3740 wrote to memory of 2364 3740 reg.exe 117 PID 3740 wrote to memory of 2364 3740 reg.exe 117 PID 3740 wrote to memory of 4724 3740 reg.exe 116 PID 3740 wrote to memory of 4724 3740 reg.exe 116 PID 3740 wrote to memory of 4724 3740 reg.exe 116 PID 3740 wrote to memory of 4272 3740 reg.exe 111 PID 3740 wrote to memory of 4272 3740 reg.exe 111 PID 3740 wrote to memory of 4272 3740 reg.exe 111 PID 4272 wrote to memory of 1440 4272 cmd.exe 118 -
System policy modification 1 TTPs 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe"C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\KoAgYYUE\FUAQMMkQ.exe"C:\Users\Admin\KoAgYYUE\FUAQMMkQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4940
-
-
C:\ProgramData\asosoccg\NwssMoIE.exe"C:\ProgramData\asosoccg\NwssMoIE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4168
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"2⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"4⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC5⤵PID:3740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"6⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"8⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC9⤵PID:4704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"10⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"12⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC13⤵PID:2508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"14⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC15⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"16⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC17⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"18⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC19⤵
- Suspicious behavior: EnumeratesProcesses
PID:868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"20⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"22⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC23⤵PID:5096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"24⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"26⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC27⤵PID:3896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"28⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"30⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC31⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"32⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC33⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"34⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC35⤵PID:792
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"36⤵PID:488
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
- Suspicious behavior: EnumeratesProcesses
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC37⤵PID:3664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"38⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC39⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"40⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC41⤵PID:3756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"42⤵PID:924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC43⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"44⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC45⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"46⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC47⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"48⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC49⤵PID:4780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"50⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC51⤵PID:644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"52⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC53⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"54⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC55⤵
- Suspicious behavior: EnumeratesProcesses
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"56⤵PID:312
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV157⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC57⤵PID:4124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"58⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC59⤵PID:3280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"60⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC61⤵PID:1796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"62⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC63⤵PID:3920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"64⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC65⤵PID:4680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"66⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC67⤵
- System policy modification
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"68⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC69⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"70⤵PID:440
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
- Modifies visibility of file extensions in Explorer
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC71⤵PID:3536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"72⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC73⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"74⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC75⤵PID:1708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"76⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC77⤵PID:4428
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"78⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC79⤵PID:4872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"80⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC81⤵PID:4300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"82⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC83⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"84⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC85⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"86⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC87⤵PID:3388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"88⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC89⤵PID:2680
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"90⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC91⤵PID:1480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"92⤵PID:4808
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC93⤵PID:4724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"94⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC95⤵PID:1308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"96⤵
- System policy modification
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC97⤵PID:4164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"98⤵PID:4772
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV199⤵
- UAC bypass
PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC99⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"100⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC101⤵PID:1096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"102⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC103⤵PID:2172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"104⤵PID:4584
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:4288
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC105⤵
- System policy modification
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"106⤵PID:3016
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC107⤵
- UAC bypass
- System policy modification
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"108⤵PID:3904
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:312
-
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC109⤵PID:1652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"110⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC111⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"112⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC113⤵PID:2788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"114⤵
- System policy modification
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC115⤵PID:4736
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"116⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC117⤵PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"118⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC119⤵PID:4176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"120⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC.exeC:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC121⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fd1be1572ed245d5e2eb8afafe803451_virlock_JC"122⤵PID:496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-