Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
ViraLock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ViraLock.exe
Resource
win10v2004-20241007-en
General
-
Target
ViraLock.exe
-
Size
194KB
-
MD5
8803d517ac24b157431d8a462302b400
-
SHA1
b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e
-
SHA256
418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786
-
SHA512
38fdfe0bc873e546b05a8680335526eec61ccc8cf3f37c60eee0bc83ec54570077f1dc1da26142488930eabcc21cb7a33c1b545a194cbfb4c87e430c4b2bfb50
-
SSDEEP
3072:slkfrcHVaq65Oe/ALwm19MYDzMLGquSOt+nSmgevSvoWAnvN0bfINcfln8rvK:Wkfrc0q47/UwQFSFnH9SArvakSflnCS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation PUoYIEYM.exe -
Executes dropped EXE 2 IoCs
pid Process 2112 PUoYIEYM.exe 1832 LOsIYMoo.exe -
Loads dropped DLL 20 IoCs
pid Process 2380 ViraLock.exe 2380 ViraLock.exe 2380 ViraLock.exe 2380 ViraLock.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOsIYMoo.exe = "C:\\ProgramData\\WckYwYcA\\LOsIYMoo.exe" ViraLock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\PUoYIEYM.exe = "C:\\Users\\Admin\\fAIYwUEw\\PUoYIEYM.exe" PUoYIEYM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LOsIYMoo.exe = "C:\\ProgramData\\WckYwYcA\\LOsIYMoo.exe" LOsIYMoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\PUoYIEYM.exe = "C:\\Users\\Admin\\fAIYwUEw\\PUoYIEYM.exe" ViraLock.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico PUoYIEYM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2816 reg.exe 1676 reg.exe 3056 reg.exe 1376 reg.exe 1248 reg.exe 1728 reg.exe 540 reg.exe 2384 reg.exe 888 reg.exe 1592 reg.exe 3032 reg.exe 948 reg.exe 808 reg.exe 1988 reg.exe 2572 reg.exe 2244 reg.exe 2924 reg.exe 2280 reg.exe 1372 reg.exe 1036 reg.exe 3028 reg.exe 2272 reg.exe 832 reg.exe 980 reg.exe 2548 reg.exe 2936 reg.exe 2716 reg.exe 1956 reg.exe 2420 reg.exe 1640 reg.exe 2240 reg.exe 2812 reg.exe 1516 reg.exe 2128 reg.exe 1736 reg.exe 2492 reg.exe 2664 reg.exe 1584 reg.exe 796 reg.exe 2896 reg.exe 1696 reg.exe 532 reg.exe 800 reg.exe 1720 reg.exe 2604 reg.exe 1056 reg.exe 1936 reg.exe 480 reg.exe 1960 reg.exe 2916 reg.exe 2520 reg.exe 1716 reg.exe 2436 reg.exe 2724 reg.exe 3056 reg.exe 2820 reg.exe 2804 reg.exe 2644 reg.exe 2924 reg.exe 1084 reg.exe 2916 reg.exe 2584 reg.exe 2008 reg.exe 2340 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2380 ViraLock.exe 2380 ViraLock.exe 1988 ViraLock.exe 1988 ViraLock.exe 2664 ViraLock.exe 2664 ViraLock.exe 296 ViraLock.exe 296 ViraLock.exe 2732 ViraLock.exe 2732 ViraLock.exe 1620 ViraLock.exe 1620 ViraLock.exe 1592 ViraLock.exe 1592 ViraLock.exe 2576 ViraLock.exe 2576 ViraLock.exe 2612 ViraLock.exe 2612 ViraLock.exe 808 ViraLock.exe 808 ViraLock.exe 2808 ViraLock.exe 2808 ViraLock.exe 1660 ViraLock.exe 1660 ViraLock.exe 1948 ViraLock.exe 1948 ViraLock.exe 2584 ViraLock.exe 2584 ViraLock.exe 2780 ViraLock.exe 2780 ViraLock.exe 1716 ViraLock.exe 1716 ViraLock.exe 1548 ViraLock.exe 1548 ViraLock.exe 900 ViraLock.exe 900 ViraLock.exe 880 ViraLock.exe 880 ViraLock.exe 2376 ViraLock.exe 2376 ViraLock.exe 2668 ViraLock.exe 2668 ViraLock.exe 2276 ViraLock.exe 2276 ViraLock.exe 1960 ViraLock.exe 1960 ViraLock.exe 680 ViraLock.exe 680 ViraLock.exe 3056 ViraLock.exe 3056 ViraLock.exe 2876 ViraLock.exe 2876 ViraLock.exe 2972 ViraLock.exe 2972 ViraLock.exe 2556 ViraLock.exe 2556 ViraLock.exe 1992 ViraLock.exe 1992 ViraLock.exe 1144 ViraLock.exe 1144 ViraLock.exe 1936 ViraLock.exe 1936 ViraLock.exe 1384 ViraLock.exe 1384 ViraLock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2112 PUoYIEYM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe 2112 PUoYIEYM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2112 2380 ViraLock.exe 28 PID 2380 wrote to memory of 2112 2380 ViraLock.exe 28 PID 2380 wrote to memory of 2112 2380 ViraLock.exe 28 PID 2380 wrote to memory of 2112 2380 ViraLock.exe 28 PID 2380 wrote to memory of 1832 2380 ViraLock.exe 29 PID 2380 wrote to memory of 1832 2380 ViraLock.exe 29 PID 2380 wrote to memory of 1832 2380 ViraLock.exe 29 PID 2380 wrote to memory of 1832 2380 ViraLock.exe 29 PID 2380 wrote to memory of 2572 2380 ViraLock.exe 30 PID 2380 wrote to memory of 2572 2380 ViraLock.exe 30 PID 2380 wrote to memory of 2572 2380 ViraLock.exe 30 PID 2380 wrote to memory of 2572 2380 ViraLock.exe 30 PID 2380 wrote to memory of 2128 2380 ViraLock.exe 32 PID 2380 wrote to memory of 2128 2380 ViraLock.exe 32 PID 2380 wrote to memory of 2128 2380 ViraLock.exe 32 PID 2380 wrote to memory of 2128 2380 ViraLock.exe 32 PID 2380 wrote to memory of 1268 2380 ViraLock.exe 33 PID 2380 wrote to memory of 1268 2380 ViraLock.exe 33 PID 2380 wrote to memory of 1268 2380 ViraLock.exe 33 PID 2380 wrote to memory of 1268 2380 ViraLock.exe 33 PID 2572 wrote to memory of 1988 2572 cmd.exe 34 PID 2572 wrote to memory of 1988 2572 cmd.exe 34 PID 2572 wrote to memory of 1988 2572 cmd.exe 34 PID 2572 wrote to memory of 1988 2572 cmd.exe 34 PID 2380 wrote to memory of 1964 2380 ViraLock.exe 35 PID 2380 wrote to memory of 1964 2380 ViraLock.exe 35 PID 2380 wrote to memory of 1964 2380 ViraLock.exe 35 PID 2380 wrote to memory of 1964 2380 ViraLock.exe 35 PID 2380 wrote to memory of 2976 2380 ViraLock.exe 37 PID 2380 wrote to memory of 2976 2380 ViraLock.exe 37 PID 2380 wrote to memory of 2976 2380 ViraLock.exe 37 PID 2380 wrote to memory of 2976 2380 ViraLock.exe 37 PID 2976 wrote to memory of 2696 2976 cmd.exe 41 PID 2976 wrote to memory of 2696 2976 cmd.exe 41 PID 2976 wrote to memory of 2696 2976 cmd.exe 41 PID 2976 wrote to memory of 2696 2976 cmd.exe 41 PID 1988 wrote to memory of 2456 1988 ViraLock.exe 42 PID 1988 wrote to memory of 2456 1988 ViraLock.exe 42 PID 1988 wrote to memory of 2456 1988 ViraLock.exe 42 PID 1988 wrote to memory of 2456 1988 ViraLock.exe 42 PID 2456 wrote to memory of 2664 2456 cmd.exe 44 PID 2456 wrote to memory of 2664 2456 cmd.exe 44 PID 2456 wrote to memory of 2664 2456 cmd.exe 44 PID 2456 wrote to memory of 2664 2456 cmd.exe 44 PID 1988 wrote to memory of 2604 1988 ViraLock.exe 45 PID 1988 wrote to memory of 2604 1988 ViraLock.exe 45 PID 1988 wrote to memory of 2604 1988 ViraLock.exe 45 PID 1988 wrote to memory of 2604 1988 ViraLock.exe 45 PID 1988 wrote to memory of 2492 1988 ViraLock.exe 46 PID 1988 wrote to memory of 2492 1988 ViraLock.exe 46 PID 1988 wrote to memory of 2492 1988 ViraLock.exe 46 PID 1988 wrote to memory of 2492 1988 ViraLock.exe 46 PID 1988 wrote to memory of 2508 1988 ViraLock.exe 48 PID 1988 wrote to memory of 2508 1988 ViraLock.exe 48 PID 1988 wrote to memory of 2508 1988 ViraLock.exe 48 PID 1988 wrote to memory of 2508 1988 ViraLock.exe 48 PID 1988 wrote to memory of 2912 1988 ViraLock.exe 49 PID 1988 wrote to memory of 2912 1988 ViraLock.exe 49 PID 1988 wrote to memory of 2912 1988 ViraLock.exe 49 PID 1988 wrote to memory of 2912 1988 ViraLock.exe 49 PID 2912 wrote to memory of 856 2912 cmd.exe 53 PID 2912 wrote to memory of 856 2912 cmd.exe 53 PID 2912 wrote to memory of 856 2912 cmd.exe 53 PID 2912 wrote to memory of 856 2912 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exe"C:\Users\Admin\AppData\Local\Temp\ViraLock.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\fAIYwUEw\PUoYIEYM.exe"C:\Users\Admin\fAIYwUEw\PUoYIEYM.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2112
-
-
C:\ProgramData\WckYwYcA\LOsIYMoo.exe"C:\ProgramData\WckYwYcA\LOsIYMoo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1832
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"2⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"4⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"6⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:296 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"8⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"10⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"12⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"14⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"16⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"18⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"20⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock21⤵
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"22⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"24⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"26⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"28⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"30⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"32⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"34⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock35⤵
- Suspicious behavior: EnumeratesProcesses
PID:900 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"36⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock37⤵
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"38⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"40⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock41⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"42⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock43⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"44⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock45⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"46⤵
- System Location Discovery: System Language Discovery
PID:264 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock47⤵
- Suspicious behavior: EnumeratesProcesses
PID:680 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"48⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock49⤵
- Suspicious behavior: EnumeratesProcesses
PID:3056 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"50⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"52⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock53⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"54⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock55⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"56⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"58⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1144 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"60⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock61⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"62⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock63⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1384 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"64⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock65⤵PID:2232
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"66⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock67⤵PID:2600
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"68⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock69⤵PID:864
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"70⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock71⤵PID:1960
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"72⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock73⤵PID:700
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"74⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock75⤵PID:340
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"76⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock77⤵PID:2696
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"78⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock79⤵PID:1516
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"80⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock81⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"82⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock83⤵PID:2292
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"84⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock85⤵PID:2256
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"86⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock87⤵PID:1688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"88⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock89⤵PID:2936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"90⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock91⤵PID:2332
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"92⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock93⤵PID:2996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"94⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock95⤵PID:1500
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"96⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock97⤵PID:2792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"98⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock99⤵PID:3024
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"100⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock101⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"102⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock103⤵PID:2720
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"104⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock105⤵
- System Location Discovery: System Language Discovery
PID:280 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"106⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock107⤵PID:2944
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"108⤵
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock109⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"110⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock111⤵PID:2236
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"112⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock113⤵PID:540
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"114⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock115⤵PID:264
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"116⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock117⤵PID:2900
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"118⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock119⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"120⤵
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock121⤵PID:2804
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-