Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 12:20
General
- Target 2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe
- Size 1.6MB
- Sample260717-phy1yaev51
- SHA256 a25800a63f57c2eb430bb0c2c3d6a6c244b916c0730f3ebcb54ba6666921ce00
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs
- UAC bypass 3 TTPs 17 IoCs
- Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 51 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\OeMMcAgI\ZCoMgkEg.exe"C:\Users\Admin\OeMMcAgI\ZCoMgkEg.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\diQwoYsA\cIcYEgMo.exe"C:\ProgramData\diQwoYsA\cIcYEgMo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"20⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"22⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"24⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock25⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"26⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"28⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"30⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock31⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"32⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock33⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock"34⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ukgoQQMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGAwIwIA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YOkAogYE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""30⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JyAEwAQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lYUMsosQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KcsswkUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GSkYcYUE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uMgEcIkk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\luUUEgMk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TuwwcMQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zSUYgoMs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OWQIIEcU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OsYMwUQQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fMsQIEwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMEsUcQw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MqMYAwIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgUksgIE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
-
C:\ProgramData\aCwkIgQA\SMUkgQYM.exeC:\ProgramData\aCwkIgQA\SMUkgQYM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\diQwoYsA\cIcYEgMo.exeC:\ProgramData\diQwoYsA\cIcYEgMo.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\OeMMcAgI\ZCoMgkEg.exeC:\Users\Admin\OeMMcAgI\ZCoMgkEg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
windowsdesktop-runtime-6.0.27-win-x64.exe
SCUA.txt
SMUkgQYM.exe
cIcYEgMo.exe
cIcYEgMo.inf
cIcYEgMo.inf
cIcYEgMo.inf
cIcYEgMo.inf
flapper.gif.exe
128.png.exe
128.png.exe
96.png.exe
128.png.exe
96.png.exe
128.png.exe
128.png.exe
AppErrorWhite.png.exe
QuotaError.png.exe
squaretile.png.exe
tinytile.png.exe
2026-07-17_ee032bb6c220bc8c492355c65e42e4dc_elex_virlock
YgUksgIE.bat
file.vbs
ShowInvoke.xlsm.exe
TestStart.wma.exe
UseRestart.exe
RemoveSkip.mp3.exe
DisconnectExpand.docx.exe
ZCoMgkEg.exe
ZCoMgkEg.inf
ZCoMgkEg.inf
AMMS.exe
AMos.exe
AWok.ico
AkAC.exe
Awws.exe
CIEk.exe
CQgC.exe
CcMY.exe
CwoG.exe
EAEk.exe
EAYy.exe
EAgY.exe
EIkE.ico
EUce.exe
EUwM.exe
EcUS.exe
EcoC.exe
EoAg.exe
GAQc.exe
Gooc.exe
IAUi.exe
IIAy.exe
IUYW.exe
IUkW.exe
IsAK.exe
IsEE.ico
KAos.ico
KEsQ.exe
KMQe.exe
KYUw.exe
KYcM.exe
KYse.exe
Kkky.exe
Kwss.exe
MMUW.exe
MYQu.exe
MkAi.exe
OMAS.exe
OQQi.exe
OQUy.exe
Oggc.exe
OqMc.ico
OskQ.exe
OskQ.exe
OwQa.exe
QMEU.exe
QQMm.exe
QYIw.exe
QYkk.exe
Qgkc.exe
QkIK.exe
QoYy.exe
QosQ.exe
SEAw.exe
SKwg.ico
SMUa.exe
SYAC.exe
Swwk.exe
UAMc.exe
UEQe.exe
UQgm.exe
UgIe.exe
UgcW.exe
UwwO.exe
WAUE.exe
WAka.exe
WAwU.exe
WQMM.exe
WkUC.exe
WoUQ.exe
WsMK.exe
YIsE.exe
YYgy.exe
Ygce.exe
Ygsq.exe
YsUE.ico
YwgM.exe
aAoQ.exe
aMQy.exe
aYAI.exe
acEy.exe
agEe.exe
amQw.ico
cAAU.exe
cEAA.exe
cIom.exe
cQMk.exe
cQwK.exe
cwss.exe
eEMS.exe
eoMA.exe
gQoc.exe
gcIM.ico
gkoo.exe
goYC.exe
gsco.exe
guUE.ico
iYcU.exe
iksu.exe
ioEG.exe
ioEk.exe
iooO.exe
isQa.exe
iswi.exe
kEkM.exe
kIYG.exe
kMQQ.exe
kMoS.exe
kgEg.ico
kkIg.exe
kwcc.exe
mEEY.exe
mIcy.exe
mMAU.exe
mgYm.exe
mkUm.exe
mksg.exe
moEy.exe
moMi.exe
oEYo.exe
oIII.exe
oMsm.exe
oQwa.exe
oYco.exe
ogcm.exe
oosI.exe
owEE.exe
qIUK.exe
qUQE.exe
qgQs.exe
qgUG.exe
qgsA.exe
qkoe.exe
sAcW.exe
sAos.exe
sIAS.exe
sIUo.exe
sUYu.exe
sccw.exe
swQC.exe
uAgY.exe
uEMw.exe
uEgm.exe
uQEc.exe
uQUQ.exe
uYAS.exe
uckc.exe
uosY.exe
wEYA.exe
wIUQ.exe
wQQm.exe
wUYE.exe
wUcY.exe
wcIU.exe
wmMY.ico
wqIw.ico
wscY.ico
wwMe.exe
wwce.exe
yIAi.exe
yQIK.exe
yQwo.exe
yUAK.exe
yYUI.exe
ygMM.exe
yoEW.exe
yswm.exe
ywYi.exe
memory/456-46-0x0000000000400000-0x0000000000592000-memory.dmp
memory/460-33-0x0000000000400000-0x0000000000590000-memory.dmp
memory/460-2628-0x0000000000400000-0x0000000000590000-memory.dmp
memory/980-15-0x0000000000400000-0x0000000000590000-memory.dmp
memory/980-2605-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1044-165-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1044-153-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1152-29-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1152-2623-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1484-116-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1484-127-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1592-314-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1592-402-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1788-98-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1788-115-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2412-55-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2412-47-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2580-85-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2580-95-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2792-199-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2792-206-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2828-156-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3040-18-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3040-2610-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3456-2600-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3456-10-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3664-88-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3664-77-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3884-198-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3884-186-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3900-290-0x0000000000400000-0x0000000000592000-memory.dmp
memory/3900-234-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4168-207-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4168-225-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4480-61-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4480-69-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4576-124-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4576-138-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4996-26-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4996-1-0x0000000004170000-0x0000000004190000-memory.dmp
memory/4996-0-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4996-27-0x0000000004170000-0x0000000004190000-memory.dmp
memory/5036-185-0x0000000000400000-0x0000000000592000-memory.dmp
memory/5036-170-0x0000000000400000-0x0000000000592000-memory.dmp