File name:

2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock

Full analysis: https://app.any.run/tasks/9cbac6b1-93ac-43e7-bc12-b37544f5a05f
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 05:25:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
virlock
ransomware
stealer
nsb
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

0D7A340F7FEE036C764994279E6D66CD

SHA1:

F5556BFDD822D84EA795E5F3EAEBB09892F333B3

SHA256:

9C87960D54EDF8F4B4F1559DF83E9470E0D8E10B9B3F33207E6D8F1AA58D2440

SSDEEP:

24576:xupGf4fajxOwT3SZ2yT7QuouiwDOYUBjZ2BmUkeZy9:xup7fajxnT3SZlT7QuouiwDFUBjZomU6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • VIRLOCK mutex has been found

      • XWAQAQUE.exe (PID: 6276)
      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • SwoYcckM.exe (PID: 6256)

    • Changes the autorun value in the registry

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • SwoYcckM.exe (PID: 6256)
      • XWAQAQUE.exe (PID: 6276)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

    • Modifies files in the Chrome extension folder

      • SwoYcckM.exe (PID: 6256)

    • Connects to the CnC server

      • XWAQAQUE.exe (PID: 6276)
      • SwoYcckM.exe (PID: 6256)

    • Actions looks like stealing of personal data

      • SwoYcckM.exe (PID: 6256)

    • NSB has been detected (SURICATA)

      • SwoYcckM.exe (PID: 6256)
      • XWAQAQUE.exe (PID: 6276)

    • RANSOMWARE has been detected

      • SwoYcckM.exe (PID: 6256)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Executable content was dropped or overwritten

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)
      • SwoYcckM.exe (PID: 6256)

    • Starts CMD.EXE for commands execution

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)

    • Uses REG/REGEDIT.EXE to modify registry

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)

    • The executable file from the user directory is run by the CMD process

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)

    • Starts a Microsoft application from unusual location

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

    • Starts itself from another location

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Searches for installed software

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Connects to unusual port

      • SwoYcckM.exe (PID: 6256)
      • XWAQAQUE.exe (PID: 6276)

    • Reads security settings of Internet Explorer

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Creates a software uninstall entry

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

  • INFO

    • The sample compiled with english language support

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

    • Reads the computer name

      • SwoYcckM.exe (PID: 6256)
      • XWAQAQUE.exe (PID: 6276)
      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

    • Checks supported languages

      • SwoYcckM.exe (PID: 6256)
      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • XWAQAQUE.exe (PID: 6276)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)

    • Creates files in the program directory

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • XWAQAQUE.exe (PID: 6276)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6952)
      • SwoYcckM.exe (PID: 6256)

    • Create files in a temporary directory

      • 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe (PID: 6236)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6356)
      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Process checks computer location settings

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)
      • SwoYcckM.exe (PID: 6256)

    • The process uses the downloaded file

      • dotnet-runtime-5.0.6-win-x64.exe (PID: 6608)

    • Creates files or folders in the user directory

      • SwoYcckM.exe (PID: 6256)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • SwoYcckM.exe (PID: 6256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:01 00:02:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 816640
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0xc2f63
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
14
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #VIRLOCK 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe #VIRLOCK swoycckm.exe #VIRLOCK xwaqaque.exe cmd.exe no specs conhost.exe no specs reg.exe no specs dotnet-runtime-5.0.6-win-x64.exe reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs dotnet-runtime-5.0.6-win-x64.exe dotnet-runtime-5.0.6-win-x64.exe

Process information

PID
CMD
Path
Indicators
Parent process
6236"C:\Users\admin\Desktop\2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe" C:\Users\admin\Desktop\2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
6256"C:\Users\admin\lEMYkwoU\SwoYcckM.exe"C:\Users\admin\lEMYkwoU\SwoYcckM.exe
2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\lemykwou\swoycckm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
6276"C:\ProgramData\usAgAgoI\XWAQAQUE.exe"C:\ProgramData\usAgAgoI\XWAQAQUE.exe
2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\programdata\usagagoi\xwaqaque.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
6292C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\dotnet-runtime-5.0.6-win-x64.exe C:\Windows\SysWOW64\cmd.exe—2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6348reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6356C:\Users\admin\AppData\Local\Temp\dotnet-runtime-5.0.6-win-x64.exe C:\Users\admin\AppData\Local\Temp\dotnet-runtime-5.0.6-win-x64.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Runtime - 5.0.6 (x64)
Exit code:
1
Version:
5.0.6.30020
Modules
Images
c:\users\admin\appdata\local\temp\dotnet-runtime-5.0.6-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6364reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2C:\Windows\SysWOW64\reg.exe—2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6380reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 973
Read events
1 936
Write events
30
Delete events
7

Modification events

(PID) Process:(6236) 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(6236) 2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
(PID) Process:(6256) SwoYcckM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(6276) XWAQAQUE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundleCachePath
Value:
C:\ProgramData\Package Cache\{459fa3de-c871-4392-b56b-006ddd706d3c}\dotnet-runtime-5.0.6-win-x64.exe
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundleUpgradeCode
Value:
{6D6E1D0E-58F3-4C1B-47B9-32F9A4A68D0B}
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(6952) dotnet-runtime-5.0.6-win-x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{459fa3de-c871-4392-b56b-006ddd706d3c}
Operation:writeName:BundleVersion
Value:
5.0.6.30020
Executable files
493
Suspicious files
1
Text files
152
Unknown types
0

Dropped files

PID
Process
Filename
Type
62362024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exeC:\ProgramData\usAgAgoI\XWAQAQUE.exeexecutable
MD5:3D81C75D2516614CA8C8EE3D8195E578
SHA256:76DAA88A6FEFB3EEDE51F627A87144DA8845B330494493B55F573A8DF5D83CFA
62362024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exeC:\Users\admin\AppData\Local\Temp\dotnet-runtime-5.0.6-win-x64.exeexecutable
MD5:9B610A7409EBC0BCEB522415F8A9AFEC
SHA256:39E6EF9C331E0129082766936AC211C63624D692DE38D6A9F29AF462F7E30EE6
6276XWAQAQUE.exeC:\ProgramData\usAgAgoI\XWAQAQUE.inftext
MD5:C4252127E029FDC5C9EEB3396BEF5B25
SHA256:43F149D4739F865FB2EE41B8D6F3F722442907092894050C6FDCD31A7142C330
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\1028\thm.wxlxml
MD5:518E7650B3AD6218E1CE96E156DF544A
SHA256:50109347FC59574721AA233C5D4C1088DE5D57A89DDCEA02D388C79676D39F16
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\1045\thm.wxlxml
MD5:0045F70232184C33B2A11E8E43E910F0
SHA256:F4EEAA698C20FCCD804D390E523D58AE8EAA0DFA3CD1C4CA4B8205B5DBD9DF56
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\thm.wxlxml
MD5:F44C2959EEEFF784D8ACA917A909D906
SHA256:835AA38B22480E84CCDF9F925EF2CD640E015BC2077674A6313C5175EA3DB5BE
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\1031\thm.wxlxml
MD5:E0E2317B04F6BA08AD3AD2864FA9665F
SHA256:CDDCAA846CA29C49AC65BED425776A50A341AE1A5EFEE550B235B430288D9FCF
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\wixstdba.dllexecutable
MD5:E5D8EAA8B7DC311A115484DBBF797E82
SHA256:ED6D806A19DC309DA425030BD3351BEB856E26CDEF96B93C267443D6458A1772
62362024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock.exeC:\Users\admin\AppData\Local\Temp\lWEEYgMU.battext
MD5:295AEFBCFB8544047D685DE1DE8FDDD6
SHA256:0734CE167DC5C71507704FE1900007244B675AB0BC67EDA447F61002CFEB7B7D
6608dotnet-runtime-5.0.6-win-x64.exeC:\Users\admin\AppData\Local\Temp\{3D66D8F5-32D9-46D6-8EBB-DAC43BBF989C}\.ba\1029\thm.wxlxml
MD5:62260E884C9B7CC3F1453B4E059F09D4
SHA256:1C563D1CDF06DDF607E94489E01B4C70BFF1820A1562E824D6DCEB0456B9124D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
8
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
—
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6256
SwoYcckM.exe
GET
301
142.250.184.206:80
http://google.com/
unknown
—
—
whitelisted
6276
XWAQAQUE.exe
GET
301
142.250.184.206:80
http://google.com/
unknown
—
—
whitelisted
—
—
POST
204
2.21.110.146:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2632
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6256
SwoYcckM.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
6276
XWAQAQUE.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
6256
SwoYcckM.exe
142.250.184.206:80
google.com
GOOGLE
US
whitelisted
6276
XWAQAQUE.exe
142.250.184.206:80
google.com
GOOGLE
US
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
www.bing.com
  • 2.21.110.146
  • 2.21.110.139
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
—
—
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
—
—
A Network Trojan was detected
RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2024-12-14_0d7a340f7fee036c764994279e6d66cd_virlock