Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 10:43
General
- Target 2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe
- Size 112KB
- Sample240328-mshqlagd69
- SHA256 3523a6cd753c68872b2eb2beb45f67fb79d2e0f5bcbbe6b5dc78eb7aef82379a
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs
- UAC bypass 3 TTPs 59 IoCs
- Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AYIwUYIE\AmcUkwsg.exe"C:\Users\Admin\AYIwUYIE\AmcUkwsg.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\hAoIUwYI\QUEYUccg.exe"C:\ProgramData\hAoIUwYI\QUEYUccg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"10⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"12⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"14⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"16⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"18⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"22⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"24⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"28⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"30⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"34⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"36⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"38⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"40⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"42⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"44⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"46⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"48⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"50⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"52⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"54⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"56⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"58⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"60⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"62⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"64⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"66⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"68⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"72⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"74⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"76⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"78⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"80⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"82⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"84⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"86⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"88⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"90⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"92⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"94⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"96⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"98⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"102⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"104⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"106⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"108⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"112⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"114⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock"118⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exeC:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock119⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 188120⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f118⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JsMowAAQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""118⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs119⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1116⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2116⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f116⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwIYgsEU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""116⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs117⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2114⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f114⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foUkUYAs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""114⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs115⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2112⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f112⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKkkIcME.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""112⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs113⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2110⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f110⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nEUsUQwo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""110⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs111⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1108⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2108⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f108⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qIAwEowA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""108⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs109⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1106⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2106⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f106⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RkIoQMQY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""106⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs107⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1104⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2104⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f104⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUIEsgUg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""104⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1105⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs105⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1102⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2102⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f102⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GWIcYooE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""102⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs103⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1100⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2100⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f100⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foMIYkUY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs101⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 198⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 298⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f98⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\veYIwEIw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""98⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs99⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 196⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 296⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f96⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MgsAMwsU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""96⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs97⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 194⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 294⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f94⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jmIYgowE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""94⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs95⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 192⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 292⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV193⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f92⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OOcEosQE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""92⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs93⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 190⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 290⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f90⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UAUQUoEE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs91⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 188⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 288⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f88⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\csswgUQk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""88⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs89⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 186⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 286⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f86⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yaEEowQE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""86⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs87⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 184⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 284⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f84⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kwogwUgo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""84⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV185⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs85⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 182⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 282⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f82⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VUQwAwcA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""82⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs83⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 180⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 280⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f80⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kQcYQUAE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""80⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs81⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 178⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 278⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f78⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUgEwQcc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""78⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs79⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 176⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 276⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f76⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zCQcMAUo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""76⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs77⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 174⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 274⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f74⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ksgYIoMo.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""74⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs75⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 172⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 272⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f72⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vQAUIIkU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""72⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs73⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 170⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 270⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f70⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dScYcosY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""70⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs71⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 168⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 268⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f68⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\niogkkAM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""68⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs69⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 166⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 266⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f66⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JuwAssIU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""66⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs67⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwssQMAA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XwEsAMcc.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JqcMkIcY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KKIUUcoM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VYEQQUkw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UkQQEkYs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XWYkwIgQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEgIkMMA.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TgMQgAsg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cSIkQIII.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pKsUwIsE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JgQIQwMg.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IaMYQMAw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""40⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV141⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gagUsQIw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKQwsgUM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIccAIQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IoAUUUUI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UqUoMYwM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KIkYkwsw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQUEEIoQ.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tioAkgUI.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xEQEAkEE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMMIAIAs.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEUMQoEw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sAwMMgks.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YmYAAgEU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sUkQEIkE.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gYQQsYAM.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UusQoIMk.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AqkQogEY.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PoEYwAMw.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\skEUYgIU.bat" "C:\Users\Admin\AppData\Local\Temp\2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4484 -ip 44842⤵
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv Prz77u0690G11ehFaowDWg.0.21⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
device.png.exe
background.png.exe
watermark.png.exe
user-40.png.exe
QUEYUccg.exe
AmcUkwsg.exe
AutoPlayOptIn.gif.exe
ElevatedAppBlue.png.exe
QuotaError.png.exe
ScreenshotOptIn.gif.exe
OneDriveMedTile.contrast-black_scale-100.png.exe
OneDriveMedTile.contrast-black_scale-150.png.exe
OneDriveMedTile.contrast-black_scale-200.png.exe
OneDriveMedTile.contrast-white_scale-400.png.exe
OneDriveMedTile.scale-400.png.exe
OneDriveSmallTile.contrast-black_scale-100.png.exe
OneDriveSmallTile.contrast-white_scale-100.png.exe
OneDriveSmallTile.contrast-white_scale-200.png.exe
OneDriveSmallTile.scale-125.png.exe
tinytile.png.exe
2024-03-28_075a7b2ad4f8f6c5b36377ee28d16f89_virlock
BQkY.exe
BsUE.exe
Dcgc.exe
FYcm.exe
FcMK.exe
FwkC.exe
GoUS.exe
HskK.exe
IAwK.exe
IIka.exe
IgoW.exe
JooE.exe
LIsY.exe
LIsw.exe
NEIs.exe
NMQe.exe
NkUM.exe
OAAO.exe
OscI.exe
PQIw.ico
QYko.exe
RUYy.exe
RYMO.exe
SAUk.exe
SEsE.exe
TcIu.exe
ToEm.exe
UYcC.exe
UcMG.exe
VgQA.exe
WIkA.exe
XIYO.exe
XMwm.exe
XQgY.exe
XwAm.exe
YYAG.exe
YYwe.exe
aEUS.exe
awwS.exe
bkYm.ico
bssO.exe
bwEG.exe
cYMO.exe
cscI.exe
dAUG.exe
dgka.ico
doMe.exe
ekIc.exe
fYsa.exe
file.vbs
gsEO.exe
hEEI.exe
hQUE.exe
iIUG.exe
jIYa.exe
jIYk.ico
jwAI.exe
kIgi.exe
kMss.exe
kQMO.exe
lMoI.exe
lYAg.exe
lgMu.exe
mQEQ.exe
mgQq.exe
mosc.exe
nUcc.exe
noAG.exe
oMgs.exe
pAkG.exe
qIQq.exe
rAkm.exe
rcAE.exe
rkos.exe
rsoQ.exe
skEUYgIU.bat
swwQ.exe
tQwu.exe
ukYc.exe
uwQK.exe
wIog.exe
wQwe.exe
xAQO.exe
xAgK.exe
xIAK.exe
xQIO.exe
xswS.exe
yIge.exe
yMAS.exe
yMYk.exe
ysUW.exe
zEMA.exe
zIQC.exe
zwkq.exe
AssertInvoke.mp3.exe
memory/228-105-0x0000000000400000-0x000000000041E000-memory.dmp
memory/228-114-0x0000000000400000-0x000000000041E000-memory.dmp
memory/400-271-0x0000000000400000-0x000000000041E000-memory.dmp
memory/400-260-0x0000000000400000-0x000000000041E000-memory.dmp
memory/404-323-0x0000000000400000-0x000000000041E000-memory.dmp
memory/556-357-0x0000000000400000-0x000000000041E000-memory.dmp
memory/556-346-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1268-285-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1268-297-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1408-358-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1408-366-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1412-367-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1504-46-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1504-56-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1580-214-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1580-195-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1748-280-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1768-199-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1768-183-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1864-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1864-19-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2008-102-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2056-123-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2056-138-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2112-91-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2112-76-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2188-31-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2188-42-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2484-14-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2580-13-0x0000000000400000-0x000000000041D000-memory.dmp
memory/2720-239-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2720-223-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2900-339-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2912-175-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2912-160-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2984-80-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2984-69-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3012-314-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3012-306-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3436-187-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3436-171-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3448-349-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3448-341-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3504-331-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3504-319-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3652-227-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3652-210-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3948-250-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3948-236-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4108-67-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4108-53-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4220-150-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4220-163-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4380-115-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4380-127-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4512-263-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4512-251-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4536-139-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4536-151-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4600-305-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4772-289-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4772-277-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4952-30-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4952-20-0x0000000000400000-0x000000000041E000-memory.dmp