Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 22:07
General
- Target 2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe
- Size 1.6MB
- Sample260820-11ynnszvb1
- SHA256 4f020c8cfcad70394c7118cef558fa3f67f42c3916959f6f89807a5b0a325c43
Score
10/10
Malware Config
Signatures
- Family: Nabucur
Nabucur is a ransomware first seen in 2015.
- Modifies visibility of file extensions in Explorer 2 TTPs 23 IoCs
- UAC bypass 3 TTPs 23 IoCs
- Renames multiple (100) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 7 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 23 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 46 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 20 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\KYQQgAss\FMIIQAwk.exe"C:\Users\Admin\KYQQgAss\FMIIQAwk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
-
-
C:\ProgramData\CAgkAwII\tMwYsssI.exe"C:\ProgramData\CAgkAwII\tMwYsssI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock19⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"20⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"22⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock23⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"26⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock27⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock29⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock31⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"34⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"38⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock39⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock41⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"42⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"44⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exeC:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock"46⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\paMUggUU.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUAkkEUM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""44⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV145⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV143⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MkMggcsA.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""42⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\keswEwww.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""40⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oqIkIkMg.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""38⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jsEgMUEE.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""36⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LscowMEk.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV133⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ykQYYUQI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""32⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CGMUgAEo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵
-
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yEoEQgEI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OYgcMQUs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dycMUQIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""24⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xmEEYggY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""22⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYYUEUIs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""20⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AgooUEIo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""18⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sWsQYscI.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GuMIIMMo.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xAcoQEcs.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQUUgkAY.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SeUQAkAM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OCockkQM.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\riUAsUwQ.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zCMwwQco.bat" "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\RiwgYckU\OQcQsgsA.exeC:\ProgramData\RiwgYckU\OQcQsgsA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
-
C:\ProgramData\CAgkAwII\tMwYsssI.exeC:\ProgramData\CAgkAwII\tMwYsssI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\KYQQgAss\FMIIQAwk.exeC:\Users\Admin\KYQQgAss\FMIIQAwk.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
tMwYsssI.exe
tMwYsssI.inf
tMwYsssI.inf
tMwYsssI.inf
tMwYsssI.inf
tMwYsssI.inf
GWIU.txt
OQcQsgsA.exe
2026-08-20_2dbecc787f048dcf089e8fd8226029b2_elex_virlock
AIQy.exe
AgAY.exe
Aocu.exe
CAsc.ico
CUUA.exe
CUYG.exe
CUkw.ico
CYEU.exe
CwYc.exe
EOsY.ico
EYIk.exe
GAoi.exe
GIAw.exe
GgQC.exe
GkYU.exe
IEQE.exe
IEkQ.exe
IIEU.exe
IQUy.exe
IUIQ.exe
IUwy.exe
Icww.exe
IowW.exe
KEMS.exe
Ksoq.exe
MEUo.exe
MMoI.exe
Msci.exe
OAUq.exe
OEcM.exe
OQIU.exe
OYcs.exe
QAcM.exe
QEAu.exe
QEYk.exe
QMIa.exe
QQgC.exe
QgYq.exe
QwsK.exe
SIkc.exe
SkMq.exe
SwYc.exe
Swoo.exe
UAwA.exe
UEUC.exe
UMAa.exe
UMYU.exe
UUUM.exe
UUYs.exe
UUoC.exe
UsAA.exe
UsAW.exe
Uwsg.exe
WAgC.exe
WEUg.exe
WMQq.exe
WMwq.exe
WUkg.exe
WYIG.exe
WYYi.exe
WoQG.exe
Wssg.exe
YAgA.exe
YUsm.exe
Ygse.exe
Yscg.exe
YwcW.exe
aAMu.exe
csgC.exe
cwUE.exe
eIAw.exe
eQEa.exe
file.vbs
gEAO.exe
gEMe.exe
gEse.exe
ggkg.exe
gwAo.exe
gwMC.exe
iIEk.exe
iIou.exe
iQga.exe
igEa.exe
igka.exe
kAcM.exe
kAgU.exe
kGMY.ico
kicE.ico
kwwS.exe
mAAC.exe
mEUA.exe
mIYW.exe
mMYy.exe
mQgE.exe
mUYA.exe
mYQg.ico
mocy.exe
muQk.ico
mwEG.exe
oEQS.exe
oQso.exe
oqYM.ico
owMs.exe
qMcY.exe
qYsM.exe
qsIQ.exe
qsQu.exe
qwom.exe
sEgK.exe
sQka.exe
sYkM.exe
ssEw.exe
swEk.exe
uUEG.exe
ucAI.exe
ucAU.exe
ukIk.ico
uwsq.exe
wQEi.exe
wUQI.ico
wUwy.exe
wYQa.exe
wcgY.exe
wcgs.exe
woIy.exe
woYo.ico
wsoU.exe
wwIq.exe
yEQu.exe
yMEo.exe
yUUK.exe
ycse.exe
zCMwwQco.bat
FMIIQAwk.exe
memory/576-97-0x0000000000400000-0x0000000000593000-memory.dmp
memory/856-321-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1376-79-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1380-1951-0x0000000000400000-0x0000000000590000-memory.dmp
memory/1436-290-0x0000000000400000-0x0000000000593000-memory.dmp
memory/1536-228-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2188-281-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2328-181-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2328-201-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2360-215-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2372-185-0x0000000000400000-0x0000000000593000-memory.dmp
memory/2832-155-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3012-1927-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3012-330-0x0000000002370000-0x0000000002390000-memory.dmp
memory/3012-8-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3012-1758-0x0000000002370000-0x0000000002390000-memory.dmp
memory/3168-248-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3348-67-0x0000000000400000-0x0000000000593000-memory.dmp
memory/3588-1937-0x0000000000400000-0x0000000000590000-memory.dmp
memory/3588-21-0x0000000000400000-0x0000000000590000-memory.dmp
memory/4108-140-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4312-238-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4480-125-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4708-31-0x0000000002340000-0x0000000002360000-memory.dmp
memory/4708-30-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4708-1-0x0000000002340000-0x0000000002360000-memory.dmp
memory/4708-0-0x0000000000400000-0x0000000000593000-memory.dmp
memory/4724-1932-0x0000000000400000-0x000000000058F000-memory.dmp
memory/4724-16-0x0000000000400000-0x000000000058F000-memory.dmp
memory/5176-300-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5272-269-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5280-169-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5524-34-0x0000000000400000-0x000000000058F000-memory.dmp
memory/5524-1946-0x0000000000400000-0x000000000058F000-memory.dmp
memory/5656-312-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5720-259-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5744-111-0x0000000000400000-0x0000000000593000-memory.dmp
memory/5784-48-0x0000000000400000-0x0000000000593000-memory.dmp