Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 10:30
General
- Target 2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe
- Size 1.6MB
- Sample260814-mkap1shq2z
- SHA256 b782bdfa87d59bc80d6b076f92cfbd86cbc842ddb566da2db6636861ddca9a35
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 24 IoCs
- UAC bypass 3 TTPs 24 IoCs
- Renames multiple (108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 7 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 9 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 48 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SkgscoQI\REkIwEIE.exe"C:\Users\Admin\SkgscoQI\REkIwEIE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\tGwckIcs\kUQsUIEk.exe"C:\ProgramData\tGwckIcs\kUQsUIEk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock27⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"28⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"30⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"32⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock33⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"40⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"46⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock"48⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PWkMUgYc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""48⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\raMkYcwA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEIIkokI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AQsAgEcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IKgwEMIg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kcUkoowM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKAwIUkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XikAEMIM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""34⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LEIMMMcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECcYEQwE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""30⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV129⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kSokQAsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\quMUEgcI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""26⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGogskcY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZggksYIU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NMoYQUow.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DyswYYEQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OocYYEEs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SEkEQEsY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ooogoQAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SMkIUAsQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nysIsgQg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jWAkcEkc.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YgIMoEwg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EYsoEgEU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\QSAcoAcE\zEYIwwMM.exeC:\ProgramData\QSAcoAcE\zEYIwwMM.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\SkgscoQI\REkIwEIE.exeC:\Users\Admin\SkgscoQI\REkIwEIE.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\tGwckIcs\kUQsUIEk.exe"C:\ProgramData\tGwckIcs\kUQsUIEk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\tGwckIcs\kUQsUIEk.exeC:\ProgramData\tGwckIcs\kUQsUIEk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\SkgscoQI\REkIwEIE.exe"C:\Users\Admin\SkgscoQI\REkIwEIE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
EYEI.txt
zEYIwwMM.exe
kUQsUIEk.exe
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
kUQsUIEk.inf
2026-08-14_434cccb68eb2c8fcddd51ee5636d4d97_elex_virlock
AIga.exe
AUgu.exe
AkQg.exe
AoQk.exe
Awsu.exe
CAkG.exe
CQEi.exe
CYMm.exe
CcIg.exe
CgIO.exe
CoEW.exe
CsII.exe
Csco.exe
EEgw.ico
EMom.exe
EYsoEgEU.bat
EcIE.exe
EkgY.exe
EwYk.exe
GIoy.exe
GcUw.exe
IUEC.exe
IgEe.exe
IsoI.exe
KAcm.exe
KEAC.exe
KEcQ.exe
KEgK.exe
KQcM.exe
KQss.exe
KcAk.exe
MIcY.exe
MgMU.exe
MksI.exe
MwsO.exe
OGQM.ico
OYgY.exe
OcoG.exe
OkUA.exe
Ookk.exe
OwUo.exe
OwkG.exe
QUcW.exe
SAkG.exe
SMsu.exe
SgIs.exe
UIAG.exe
UMYQ.exe
UcYS.exe
WEUq.exe
WIAY.exe
WIIw.exe
WQQY.exe
WYca.exe
WcsW.exe
WgQA.exe
Wkwc.exe
WogS.exe
YIca.exe
YIoG.exe
YUoy.exe
YqwE.ico
aMcY.exe
aOAs.ico
aUgM.exe
accA.exe
aoUe.exe
aosO.exe
assi.exe
cAQo.exe
cMAI.exe
cMMs.exe
ckca.exe
eAIM.exe
eMcq.exe
eQIe.exe
egYM.exe
eoUe.exe
file.vbs
gAMg.exe
gEYG.exe
gMQQ.exe
gMYY.exe
gYUe.exe
gccC.exe
ggYw.exe
ggsU.exe
gscW.exe
gwou.exe
iEMY.exe
iEUI.exe
iEkg.exe
iYsu.exe
igoU.ico
iswU.exe
kAAi.exe
kYQm.exe
kYkW.exe
kkgE.exe
mIEm.exe
oEsG.exe
oQkq.exe
ockO.exe
ocsg.exe
omgA.ico
osgA.exe
qAUg.exe
qAcI.exe
qYIU.exe
qcoU.exe
qsIo.exe
sAEC.exe
sAUG.exe
sEce.exe
sQoq.exe
sYco.exe
sokE.exe
swsu.exe
uEMQ.exe
uMAc.ico
uUUq.exe
uggY.exe
ukEY.exe
uoMe.exe
uwow.exe
wAEY.exe
wAkW.exe
wEIQ.exe
waUc.ico
wcUa.exe
wcwG.exe
wgUg.ico
wswK.exe
yEUG.exe
yEoi.exe
yIYG.exe
yUoY.exe
ywoq.exe
REkIwEIE.exe
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
REkIwEIE.inf
memory/396-2104-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1052-327-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1284-127-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1360-265-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1552-83-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1688-97-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1900-2091-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1900-28-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1924-184-0x0000000000400000-0x0000000000598000-memory.dmp
memory/1936-167-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2260-1-0x00000000042E0000-0x0000000004300000-memory.dmp
memory/2260-32-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2260-0-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2260-33-0x00000000042E0000-0x0000000004300000-memory.dmp
memory/2772-284-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2912-275-0x0000000000400000-0x0000000000598000-memory.dmp
memory/2996-306-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3224-235-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3376-315-0x0000000000400000-0x0000000000598000-memory.dmp
memory/3432-138-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4616-109-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4744-207-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4840-19-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4840-2078-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4852-244-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4888-153-0x0000000000400000-0x0000000000598000-memory.dmp
memory/4924-296-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5000-2274-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5056-224-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5068-7-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5068-2064-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5084-17-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5084-2071-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5324-50-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5408-65-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5600-254-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5656-198-0x0000000000400000-0x0000000000598000-memory.dmp
memory/5724-2281-0x0000000000400000-0x0000000000590000-memory.dmp
memory/5724-1790-0x0000000000400000-0x0000000000590000-memory.dmp