Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
ViraLock.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ViraLock.exe
Resource
win10v2004-20241007-en
General
-
Target
ViraLock.exe
-
Size
194KB
-
MD5
8803d517ac24b157431d8a462302b400
-
SHA1
b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e
-
SHA256
418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786
-
SHA512
38fdfe0bc873e546b05a8680335526eec61ccc8cf3f37c60eee0bc83ec54570077f1dc1da26142488930eabcc21cb7a33c1b545a194cbfb4c87e430c4b2bfb50
-
SSDEEP
3072:slkfrcHVaq65Oe/ALwm19MYDzMLGquSOt+nSmgevSvoWAnvN0bfINcfln8rvK:Wkfrc0q47/UwQFSFnH9SArvakSflnCS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation PekokQgk.exe -
Executes dropped EXE 2 IoCs
pid Process 64 PekokQgk.exe 1788 BmkIAwQc.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BmkIAwQc.exe = "C:\\ProgramData\\bokQgEMY\\BmkIAwQc.exe" ViraLock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PekokQgk.exe = "C:\\Users\\Admin\\eIYkkMYQ\\PekokQgk.exe" PekokQgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BmkIAwQc.exe = "C:\\ProgramData\\bokQgEMY\\BmkIAwQc.exe" BmkIAwQc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mMcwQwIo.exe = "C:\\Users\\Admin\\YaEAMYoY\\mMcwQwIo.exe" ViraLock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MawYYwcU.exe = "C:\\ProgramData\\RUksMkkI\\MawYYwcU.exe" ViraLock.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PekokQgk.exe = "C:\\Users\\Admin\\eIYkkMYQ\\PekokQgk.exe" ViraLock.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe PekokQgk.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe PekokQgk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2372 4164 WerFault.exe 280 4296 1624 WerFault.exe 281 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BmkIAwQc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ViraLock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 4012 reg.exe 1892 reg.exe 4920 reg.exe 2068 reg.exe 4688 reg.exe 3040 reg.exe 940 reg.exe 4656 reg.exe 3176 reg.exe 4720 reg.exe 3060 reg.exe 4664 Process not Found 4268 reg.exe 3784 reg.exe 1704 reg.exe 620 reg.exe 2372 reg.exe 1624 reg.exe 2208 Process not Found 968 Process not Found 1044 Process not Found 4220 reg.exe 4536 reg.exe 1940 reg.exe 2236 reg.exe 1496 reg.exe 2820 reg.exe 2484 reg.exe 3832 reg.exe 548 reg.exe 3436 reg.exe 1200 reg.exe 3940 reg.exe 1656 reg.exe 3788 reg.exe 3392 reg.exe 3764 reg.exe 4904 reg.exe 2468 reg.exe 3384 reg.exe 2172 reg.exe 3100 reg.exe 4192 reg.exe 3444 reg.exe 4568 reg.exe 2028 reg.exe 4340 Process not Found 3384 reg.exe 5072 reg.exe 3036 reg.exe 4092 reg.exe 2028 reg.exe 4248 reg.exe 1584 reg.exe 4360 reg.exe 4720 reg.exe 1148 reg.exe 4196 reg.exe 968 reg.exe 4184 reg.exe 4248 reg.exe 4272 reg.exe 4192 reg.exe 876 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 548 ViraLock.exe 548 ViraLock.exe 548 ViraLock.exe 548 ViraLock.exe 3872 ViraLock.exe 3872 ViraLock.exe 3872 ViraLock.exe 3872 ViraLock.exe 4016 ViraLock.exe 4016 ViraLock.exe 4016 ViraLock.exe 4016 ViraLock.exe 1576 ViraLock.exe 1576 ViraLock.exe 1576 ViraLock.exe 1576 ViraLock.exe 4352 ViraLock.exe 4352 ViraLock.exe 4352 ViraLock.exe 4352 ViraLock.exe 1672 ViraLock.exe 1672 ViraLock.exe 1672 ViraLock.exe 1672 ViraLock.exe 4296 ViraLock.exe 4296 ViraLock.exe 4296 ViraLock.exe 4296 ViraLock.exe 1720 ViraLock.exe 1720 ViraLock.exe 1720 ViraLock.exe 1720 ViraLock.exe 2564 ViraLock.exe 2564 ViraLock.exe 2564 ViraLock.exe 2564 ViraLock.exe 1708 ViraLock.exe 1708 ViraLock.exe 1708 ViraLock.exe 1708 ViraLock.exe 2424 ViraLock.exe 2424 ViraLock.exe 2424 ViraLock.exe 2424 ViraLock.exe 4164 ViraLock.exe 4164 ViraLock.exe 4164 ViraLock.exe 4164 ViraLock.exe 3956 ViraLock.exe 3956 ViraLock.exe 3956 ViraLock.exe 3956 ViraLock.exe 1344 ViraLock.exe 1344 ViraLock.exe 1344 ViraLock.exe 1344 ViraLock.exe 2600 ViraLock.exe 2600 ViraLock.exe 2600 ViraLock.exe 2600 ViraLock.exe 2036 ViraLock.exe 2036 ViraLock.exe 2036 ViraLock.exe 2036 ViraLock.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 64 PekokQgk.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe 64 PekokQgk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 64 548 ViraLock.exe 82 PID 548 wrote to memory of 64 548 ViraLock.exe 82 PID 548 wrote to memory of 64 548 ViraLock.exe 82 PID 548 wrote to memory of 1788 548 ViraLock.exe 83 PID 548 wrote to memory of 1788 548 ViraLock.exe 83 PID 548 wrote to memory of 1788 548 ViraLock.exe 83 PID 548 wrote to memory of 4780 548 ViraLock.exe 84 PID 548 wrote to memory of 4780 548 ViraLock.exe 84 PID 548 wrote to memory of 4780 548 ViraLock.exe 84 PID 548 wrote to memory of 2744 548 ViraLock.exe 86 PID 548 wrote to memory of 2744 548 ViraLock.exe 86 PID 548 wrote to memory of 2744 548 ViraLock.exe 86 PID 548 wrote to memory of 5100 548 ViraLock.exe 87 PID 548 wrote to memory of 5100 548 ViraLock.exe 87 PID 548 wrote to memory of 5100 548 ViraLock.exe 87 PID 548 wrote to memory of 4528 548 ViraLock.exe 88 PID 548 wrote to memory of 4528 548 ViraLock.exe 88 PID 548 wrote to memory of 4528 548 ViraLock.exe 88 PID 548 wrote to memory of 3472 548 ViraLock.exe 89 PID 548 wrote to memory of 3472 548 ViraLock.exe 89 PID 548 wrote to memory of 3472 548 ViraLock.exe 89 PID 4780 wrote to memory of 3872 4780 cmd.exe 94 PID 4780 wrote to memory of 3872 4780 cmd.exe 94 PID 4780 wrote to memory of 3872 4780 cmd.exe 94 PID 3472 wrote to memory of 4636 3472 cmd.exe 95 PID 3472 wrote to memory of 4636 3472 cmd.exe 95 PID 3472 wrote to memory of 4636 3472 cmd.exe 95 PID 3872 wrote to memory of 2416 3872 ViraLock.exe 96 PID 3872 wrote to memory of 2416 3872 ViraLock.exe 96 PID 3872 wrote to memory of 2416 3872 ViraLock.exe 96 PID 2416 wrote to memory of 4016 2416 cmd.exe 98 PID 2416 wrote to memory of 4016 2416 cmd.exe 98 PID 2416 wrote to memory of 4016 2416 cmd.exe 98 PID 3872 wrote to memory of 212 3872 ViraLock.exe 99 PID 3872 wrote to memory of 212 3872 ViraLock.exe 99 PID 3872 wrote to memory of 212 3872 ViraLock.exe 99 PID 3872 wrote to memory of 244 3872 ViraLock.exe 100 PID 3872 wrote to memory of 244 3872 ViraLock.exe 100 PID 3872 wrote to memory of 244 3872 ViraLock.exe 100 PID 3872 wrote to memory of 4268 3872 ViraLock.exe 101 PID 3872 wrote to memory of 4268 3872 ViraLock.exe 101 PID 3872 wrote to memory of 4268 3872 ViraLock.exe 101 PID 3872 wrote to memory of 3764 3872 ViraLock.exe 102 PID 3872 wrote to memory of 3764 3872 ViraLock.exe 102 PID 3872 wrote to memory of 3764 3872 ViraLock.exe 102 PID 3764 wrote to memory of 3992 3764 cmd.exe 107 PID 3764 wrote to memory of 3992 3764 cmd.exe 107 PID 3764 wrote to memory of 3992 3764 cmd.exe 107 PID 4016 wrote to memory of 1428 4016 ViraLock.exe 108 PID 4016 wrote to memory of 1428 4016 ViraLock.exe 108 PID 4016 wrote to memory of 1428 4016 ViraLock.exe 108 PID 4016 wrote to memory of 4440 4016 ViraLock.exe 110 PID 4016 wrote to memory of 4440 4016 ViraLock.exe 110 PID 4016 wrote to memory of 4440 4016 ViraLock.exe 110 PID 4016 wrote to memory of 636 4016 ViraLock.exe 111 PID 4016 wrote to memory of 636 4016 ViraLock.exe 111 PID 4016 wrote to memory of 636 4016 ViraLock.exe 111 PID 4016 wrote to memory of 2708 4016 ViraLock.exe 112 PID 4016 wrote to memory of 2708 4016 ViraLock.exe 112 PID 4016 wrote to memory of 2708 4016 ViraLock.exe 112 PID 4016 wrote to memory of 60 4016 ViraLock.exe 113 PID 4016 wrote to memory of 60 4016 ViraLock.exe 113 PID 4016 wrote to memory of 60 4016 ViraLock.exe 113 PID 1428 wrote to memory of 1576 1428 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exe"C:\Users\Admin\AppData\Local\Temp\ViraLock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\eIYkkMYQ\PekokQgk.exe"C:\Users\Admin\eIYkkMYQ\PekokQgk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:64
-
-
C:\ProgramData\bokQgEMY\BmkIAwQc.exe"C:\ProgramData\bokQgEMY\BmkIAwQc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"2⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"4⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"6⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"8⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"10⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"12⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"14⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"16⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock17⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"18⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"20⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"22⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"24⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"26⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"28⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"30⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"32⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock33⤵
- Adds Run key to start application
PID:1492 -
C:\Users\Admin\YaEAMYoY\mMcwQwIo.exe"C:\Users\Admin\YaEAMYoY\mMcwQwIo.exe"34⤵PID:4164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 22035⤵
- Program crash
PID:2372
-
-
-
C:\ProgramData\RUksMkkI\MawYYwcU.exe"C:\ProgramData\RUksMkkI\MawYYwcU.exe"34⤵PID:1624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 22435⤵
- Program crash
PID:4296
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"34⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock35⤵PID:3600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"36⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock37⤵PID:4720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"38⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock39⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"40⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock41⤵PID:3436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"42⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock43⤵PID:2424
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"44⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock45⤵PID:4040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"46⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock47⤵PID:944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"48⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock49⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"50⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock51⤵PID:912
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"52⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock53⤵PID:3412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"54⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock55⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"56⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock57⤵PID:4508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"58⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock59⤵PID:5072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"60⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock61⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"62⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock63⤵PID:3168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"64⤵PID:4812
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock65⤵PID:4196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"66⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock67⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"68⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock69⤵PID:3872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"70⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock71⤵PID:2516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"72⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock73⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"74⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock75⤵
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"76⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock77⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"78⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock79⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"80⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock81⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"82⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock83⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"84⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock85⤵PID:2620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"86⤵PID:324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3412
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock87⤵PID:1772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"88⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock89⤵
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"90⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock91⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"92⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock93⤵PID:3604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"94⤵PID:2276
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock95⤵PID:4092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock97⤵PID:4812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"98⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock99⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"100⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock101⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"102⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock103⤵PID:4744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"104⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock105⤵PID:3928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"106⤵PID:2840
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1107⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock107⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"108⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock109⤵PID:5012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"110⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock111⤵PID:2052
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"112⤵PID:4720
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock113⤵PID:244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"114⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock115⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"116⤵PID:4272
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock117⤵PID:3916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"118⤵PID:3436
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock119⤵PID:2548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"120⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\ViraLock.exeC:\Users\Admin\AppData\Local\Temp\ViraLock121⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ViraLock"122⤵PID:4428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-