Analysis
-
max time kernel
98s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 11:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe
-
Size
206KB
-
MD5
ae20f99045614604311b948f21bd05b9
-
SHA1
4ab0bbe3f9f7669cc1a359af1136c34af63ecda7
-
SHA256
01586d4e1494fcc1b71274863a62813802fbb09f08169414c112738b53cebfc0
-
SHA512
70243530957499fa4698a39c8b26b300650cd2c6e65e8d173a0ad7098440d182f1417e757dcb35088651d9c39a774cea597cf25857f7c4b2cf60b2f8320cebd3
-
SSDEEP
6144:umvl12Ml/2q/nCrYTfpjV4SJdKIZN6KR:Fvl11/xnAYpPKY6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cscript.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Conhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" backgroundTaskHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\Control Panel\International\Geo\Nation HoYMMUIA.exe -
Executes dropped EXE 3 IoCs
pid Process 4588 HoYMMUIA.exe 3536 HMYUsscU.exe 1352 InvokeRead.jpg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HMYUsscU.exe = "C:\\ProgramData\\OYwokQcI\\HMYUsscU.exe" HMYUsscU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HoYMMUIA.exe = "C:\\Users\\Admin\\HwoMoAkY\\HoYMMUIA.exe" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HMYUsscU.exe = "C:\\ProgramData\\OYwokQcI\\HMYUsscU.exe" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3054445511-921769590-4013668107-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HoYMMUIA.exe = "C:\\Users\\Admin\\HwoMoAkY\\HoYMMUIA.exe" HoYMMUIA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cscript.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 64 IoCs
pid Process 1488 reg.exe 2480 reg.exe 848 reg.exe 4900 reg.exe 1496 reg.exe 2260 reg.exe 3108 reg.exe 224 reg.exe 4272 reg.exe 4900 reg.exe 1156 reg.exe 2980 reg.exe 396 reg.exe 2440 reg.exe 4980 reg.exe 2784 reg.exe 3100 reg.exe 4076 reg.exe 556 reg.exe 1884 reg.exe 2184 reg.exe 4224 reg.exe 3320 reg.exe 2204 reg.exe 636 reg.exe 4152 reg.exe 836 reg.exe 4596 reg.exe 3464 reg.exe 4904 reg.exe 744 reg.exe 3100 reg.exe 812 reg.exe 2484 reg.exe 4416 reg.exe 3400 reg.exe 1136 reg.exe 2148 reg.exe 1592 reg.exe 4276 reg.exe 4368 reg.exe 556 reg.exe 1844 reg.exe 3884 reg.exe 2632 reg.exe 1392 reg.exe 4936 reg.exe 3996 reg.exe 2324 reg.exe 3412 reg.exe 1028 reg.exe 3576 reg.exe 4972 reg.exe 2836 reg.exe 3196 reg.exe 3688 reg.exe 4496 reg.exe 2064 reg.exe 2256 reg.exe 1188 reg.exe 2100 reg.exe 2804 reg.exe 3424 reg.exe 1152 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 1708 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 1708 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 1708 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 1708 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3768 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3768 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3768 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3768 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4636 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4636 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4636 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4636 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4468 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4468 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4468 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4468 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2980 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2980 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2980 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 2980 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 8 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 8 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 8 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 8 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4660 cmd.exe 4660 cmd.exe 4660 cmd.exe 4660 cmd.exe 4956 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4956 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4956 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4956 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 4420 Conhost.exe 4420 Conhost.exe 4420 Conhost.exe 4420 Conhost.exe 3636 Conhost.exe 3636 Conhost.exe 3636 Conhost.exe 3636 Conhost.exe 1852 Conhost.exe 1852 Conhost.exe 1852 Conhost.exe 1852 Conhost.exe 4700 Conhost.exe 4700 Conhost.exe 4700 Conhost.exe 4700 Conhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4588 HoYMMUIA.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe 4588 HoYMMUIA.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2888 mspaint.exe 2888 mspaint.exe 2888 mspaint.exe 2888 mspaint.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 4588 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 88 PID 460 wrote to memory of 4588 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 88 PID 460 wrote to memory of 4588 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 88 PID 460 wrote to memory of 3536 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 89 PID 460 wrote to memory of 3536 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 89 PID 460 wrote to memory of 3536 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 89 PID 460 wrote to memory of 636 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 91 PID 460 wrote to memory of 636 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 91 PID 460 wrote to memory of 636 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 91 PID 460 wrote to memory of 4980 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 93 PID 460 wrote to memory of 4980 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 93 PID 460 wrote to memory of 4980 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 93 PID 460 wrote to memory of 3176 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 94 PID 460 wrote to memory of 3176 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 94 PID 460 wrote to memory of 3176 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 94 PID 460 wrote to memory of 2800 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 96 PID 460 wrote to memory of 2800 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 96 PID 460 wrote to memory of 2800 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 96 PID 460 wrote to memory of 3144 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 95 PID 460 wrote to memory of 3144 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 95 PID 460 wrote to memory of 3144 460 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 95 PID 636 wrote to memory of 3412 636 cmd.exe 101 PID 636 wrote to memory of 3412 636 cmd.exe 101 PID 636 wrote to memory of 3412 636 cmd.exe 101 PID 3144 wrote to memory of 5000 3144 cmd.exe 102 PID 3144 wrote to memory of 5000 3144 cmd.exe 102 PID 3144 wrote to memory of 5000 3144 cmd.exe 102 PID 3412 wrote to memory of 2728 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 103 PID 3412 wrote to memory of 2728 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 103 PID 3412 wrote to memory of 2728 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 103 PID 3412 wrote to memory of 3996 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 106 PID 3412 wrote to memory of 3996 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 106 PID 3412 wrote to memory of 3996 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 106 PID 3412 wrote to memory of 1884 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 107 PID 3412 wrote to memory of 1884 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 107 PID 3412 wrote to memory of 1884 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 107 PID 3412 wrote to memory of 2012 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 108 PID 3412 wrote to memory of 2012 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 108 PID 3412 wrote to memory of 2012 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 108 PID 3412 wrote to memory of 4988 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 109 PID 3412 wrote to memory of 4988 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 109 PID 3412 wrote to memory of 4988 3412 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 109 PID 2728 wrote to memory of 2408 2728 cmd.exe 114 PID 2728 wrote to memory of 2408 2728 cmd.exe 114 PID 2728 wrote to memory of 2408 2728 cmd.exe 114 PID 4988 wrote to memory of 4368 4988 cmd.exe 115 PID 4988 wrote to memory of 4368 4988 cmd.exe 115 PID 4988 wrote to memory of 4368 4988 cmd.exe 115 PID 2408 wrote to memory of 4444 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 116 PID 2408 wrote to memory of 4444 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 116 PID 2408 wrote to memory of 4444 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 116 PID 4444 wrote to memory of 1708 4444 cmd.exe 118 PID 4444 wrote to memory of 1708 4444 cmd.exe 118 PID 4444 wrote to memory of 1708 4444 cmd.exe 118 PID 2408 wrote to memory of 3648 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 119 PID 2408 wrote to memory of 3648 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 119 PID 2408 wrote to memory of 3648 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 119 PID 2408 wrote to memory of 4828 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 123 PID 2408 wrote to memory of 4828 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 123 PID 2408 wrote to memory of 4828 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 123 PID 2408 wrote to memory of 4832 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 122 PID 2408 wrote to memory of 4832 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 122 PID 2408 wrote to memory of 4832 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 122 PID 2408 wrote to memory of 3004 2408 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe 121 -
System policy modification 1 TTPs 30 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\HwoMoAkY\HoYMMUIA.exe"C:\Users\Admin\HwoMoAkY\HoYMMUIA.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4588
-
-
C:\ProgramData\OYwokQcI\HMYUsscU.exe"C:\ProgramData\OYwokQcI\HMYUsscU.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"4⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"6⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"8⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"10⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"12⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"14⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"16⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"18⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock19⤵PID:4660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"20⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"22⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"24⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock25⤵PID:4420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"26⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock27⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"28⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock29⤵PID:1852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"30⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock31⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"32⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock33⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"34⤵PID:1032
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵PID:4952
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock35⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"36⤵PID:628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
- Modifies visibility of file extensions in Explorer
PID:1752
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock37⤵PID:3828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"38⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock39⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"40⤵PID:4636
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock41⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"42⤵PID:808
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock43⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"44⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock45⤵PID:3636
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"46⤵PID:2548
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock47⤵PID:4584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"48⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock49⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"50⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock51⤵PID:1460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"52⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock53⤵PID:3400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"54⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock55⤵PID:1444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"56⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock57⤵PID:220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"58⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock59⤵PID:2980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"60⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock61⤵PID:4408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"62⤵PID:3532
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock63⤵PID:2224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"64⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock65⤵PID:1452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"66⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock67⤵PID:1760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"68⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock69⤵
- Checks whether UAC is enabled
- System policy modification
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"70⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock71⤵PID:1016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"72⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock73⤵PID:1932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"74⤵PID:1844
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
- Modifies visibility of file extensions in Explorer
PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock75⤵PID:3444
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"76⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock77⤵PID:544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"78⤵PID:1976
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock79⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"80⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock81⤵PID:1864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"82⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock83⤵PID:3128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"84⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock85⤵PID:2608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"86⤵PID:1468
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock87⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"88⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock89⤵PID:2304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"90⤵PID:4836
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock91⤵PID:4408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"92⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock93⤵PID:3136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"94⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock95⤵PID:4432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"96⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock97⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"98⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock99⤵PID:1984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"100⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock101⤵PID:4684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"102⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock103⤵PID:2040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"104⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:4276 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock105⤵PID:2392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"106⤵PID:4024
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
- Modifies visibility of file extensions in Explorer
PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock107⤵PID:2064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"108⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock109⤵PID:4520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"110⤵PID:2328
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
- Modifies visibility of file extensions in Explorer
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock111⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"112⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock113⤵PID:2020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"114⤵
- Modifies visibility of file extensions in Explorer
PID:396 -
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock115⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"116⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock117⤵PID:4964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"118⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock119⤵PID:1760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"120⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock121⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-02-23_ae20f99045614604311b948f21bd05b9_virlock"122⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-