Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 01:57
General
- Target 2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe
- Size 251KB
- Sample260807-cdqsjsde58
- SHA256 3074c5edd63a38a57773ae25c12ed630b6431d480c71f568aadf44bb31305978
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 23 IoCs
- UAC bypass 3 TTPs 23 IoCs
- Renames multiple (142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 6 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 46 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\LSwswIYk\fcIQQYcU.exe"C:\Users\Admin\LSwswIYk\fcIQQYcU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\wycIQEcE\GMIUIcIQ.exe"C:\ProgramData\wycIQEcE\GMIUIcIQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock21⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"24⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"36⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock41⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock"46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cQAEMwss.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""46⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqsAwcQs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DAYMIcEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VksokcMw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eQgUgkEw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UqQMwkgs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OyosQoUY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QAAEUEsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PuUEsoIc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYkEsQII.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dGQkQMkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oOMAcEYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UKswIIco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YIMIUgws.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MakYMYEA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\noQYsowM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWAcEQsw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dwowwYUI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EYIoQcAw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aqAEcwkg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hsQMYocw.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nmcEAkUc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SCIAMwYI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\LSwswIYk\fcIQQYcU.exeC:\Users\Admin\LSwswIYk\fcIQQYcU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\wycIQEcE\GMIUIcIQ.exeC:\ProgramData\wycIQEcE\GMIUIcIQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
device.png.exe
superbar.png.exe
background.png.exe
watermark.png.exe
guest.png.exe
user-192.png.exe
user.bmp.exe
VC_redist.x86.exe
windowsdesktop-runtime-8.0.15-win-x64.exe
VC_redist.x64.exe
vcredist_x64.exe
windowsdesktop-runtime-6.0.27-win-x64.exe
windowsdesktop-runtime-7.0.16-win-x64.exe
vcredist_x64.exe
GMIUIcIQ.exe
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
GMIUIcIQ.inf
flapper.gif.exe
128.png.exe
192.png.exe
256.png.exe
48.png.exe
64.png.exe
128.png.exe
64.png.exe
256.png.exe
192.png.exe
256.png.exe
48.png.exe
64.png.exe
128.png.exe
AppErrorWhite.png.exe
AppWhite.png.exe
AutoPlayOptIn.gif.exe
QuotaError.png.exe
OneDriveSmallTile.contrast-black_scale-400.png.exe
OneDriveSmallTile.contrast-white_scale-400.png.exe
OneDrive.exe
tinytile.png.exe
2026-08-07_0ab7bc947542baf945cb63fbf17c19ca_elex_virlock
AkkU.exe
AsEG.ico
CAww.exe
CMAk.exe
CgMO.exe
CgUQ.exe
CwYQ.exe
EQoy.ico
EUci.exe
EkQI.ico
Eksu.exe
EoMk.exe
EwkU.exe
GMYI.exe
GQUS.exe
GYsi.exe
IEUm.exe
IEgg.exe
IksI.exe
IokU.exe
IsIw.exe
KcMA.exe
KcMc.exe
KkEK.exe
KoYg.exe
KwAY.exe
MAkc.exe
MYEe.exe
MkYW.exe
OIQU.exe
OQsI.exe
OUQY.exe
OgQg.ico
OgwG.exe
QIAU.ico
QIEc.exe
QUsG.exe
QYwm.exe
QcII.exe
QkoG.exe
QokU.exe
QsAq.exe
SCIAMwYI.bat
SMEo.exe
SMII.exe
SMQU.exe
SYcO.exe
UcAg.exe
UoQs.exe
UoYQ.exe
Uoce.exe
WAEW.exe
WIcm.exe
WIsE.exe
WYIY.exe
Wgcg.exe
Wgoc.exe
YcQW.exe
Ycwa.ico
Ygoq.exe
YscQ.exe
aIwO.exe
aMIM.exe
aYEq.exe
akQy.exe
awQU.exe
cAMW.exe
cEws.ico
cIwY.exe
cwsA.exe
eIIs.exe
eMQM.exe
eYEI.exe
file.vbs
gAUe.exe
gEwy.exe
gUQa.exe
gooQ.exe
icIS.exe
icYe.exe
iwkc.exe
kAMc.exe
kMwY.exe
kcsy.exe
kgYs.ico
kkUq.exe
koEG.exe
ksEc.exe
ksUe.exe
mAoe.exe
mcEy.exe
mcYW.exe
mcgU.exe
mgIE.exe
mocU.exe
oIoS.exe
oMos.exe
oYoA.exe
ocAo.exe
ooMw.exe
qEUc.exe
qMQg.exe
qUAW.exe
qUEK.exe
sMcc.exe
soAS.exe
soQm.exe
swkk.exe
uAUo.exe
uAwQ.exe
uEUk.exe
wMIS.exe
wcwu.exe
yEwU.ico
yUoy.exe
ygAM.exe
ykMK.ico
yoEC.exe
CompareComplete.gif.exe
CompressConvert.zip.exe
PushStep.wma.exe
TraceConvertTo.wma.exe
ConvertFromConvertTo.bmp.exe
RenameSkip.jpg.exe
HideRead.png.exe
ReadMount.mpg.exe
ResizeRestore.mp3.exe
TraceAdd.zip.exe
StopSet.jpg.exe
SendInitialize.mp3.exe
AssertCompare.gif.exe
ConvertToWait.jpg.exe
EnableCompare.mpg.exe
SyncUnlock.exe
ResumeEnter.xls.exe
SplitSync.bmp.exe
UndoAssert.jpg.exe
RenameUnregister.png.exe
GetConnect.xls.exe
InstallSplit.doc.exe
WatchReset.ppt.exe
CloseRepair.png.exe
ExpandRestart.rar.exe
SelectPublish.gif.exe
UpdateSplit.gif.exe
fcIQQYcU.exe
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
fcIQQYcU.inf
memory/64-194-0x0000000000400000-0x0000000000441000-memory.dmp
memory/116-76-0x0000000000400000-0x0000000000441000-memory.dmp
memory/116-66-0x0000000000400000-0x0000000000441000-memory.dmp
memory/696-193-0x0000000000400000-0x0000000000441000-memory.dmp
memory/696-204-0x0000000000400000-0x0000000000441000-memory.dmp
memory/872-224-0x0000000000400000-0x0000000000441000-memory.dmp
memory/872-216-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1032-215-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1196-242-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1212-134-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1212-145-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1248-277-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1248-266-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1500-48-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1500-32-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1616-249-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1616-257-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1716-155-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1720-96-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1720-106-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1864-95-0x0000000000400000-0x0000000000441000-memory.dmp
memory/1864-83-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2072-250-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2268-36-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2268-2447-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3064-0-0x0000000000400000-0x0000000000441000-memory.dmp
memory/3064-18-0x0000000000400000-0x0000000000441000-memory.dmp
memory/3608-14-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3608-2434-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3792-38-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3792-2452-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4172-65-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4172-53-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4248-135-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4408-116-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4488-169-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4900-258-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4900-265-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5148-221-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5148-231-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5476-31-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5476-19-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5600-2429-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5600-5-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5680-183-0x0000000000400000-0x0000000000441000-memory.dmp