| File name: | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock |
| Full analysis: | https://app.any.run/tasks/e6ae9344-fbd0-4cc8-9464-3db9824b7670 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 26, 2025, 23:25:59 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections |
| MD5: | 370396745C1E9FB900795BB18B9AD279 |
| SHA1: | 94EDB05AC2A17826B215E386B553EEF3EA03E80B |
| SHA256: | B91F1D2359A5B5A04C31F1CCBDACF0862B2C334ABEDD172D6C8EA7C4C86C36AC |
| SSDEEP: | 6144:a8xSaMcjfymOcZEI7K1iJi/m/CaohU7Q5iZv:a8xS6ym/EXSi/m/CdhU7+g |
MALICIOUS
VIRLOCK mutex has been found
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- SwoYcckM.exe (PID: 6308)
- XWAQAQUE.exe (PID: 6352)
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6660)
Changes the autorun value in the registry
- XWAQAQUE.exe (PID: 6352)
- SwoYcckM.exe (PID: 6308)
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
NSB has been detected (SURICATA)
- SwoYcckM.exe (PID: 6308)
- XWAQAQUE.exe (PID: 6352)
Connects to the CnC server
- SwoYcckM.exe (PID: 6308)
- XWAQAQUE.exe (PID: 6352)
Modifies files in the Chrome extension folder
- SwoYcckM.exe (PID: 6308)
Actions looks like stealing of personal data
- SwoYcckM.exe (PID: 6308)
SUSPICIOUS
Executable content was dropped or overwritten
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- SwoYcckM.exe (PID: 6308)
Starts CMD.EXE for commands execution
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
Uses REG/REGEDIT.EXE to modify registry
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
Executing commands from a ".bat" file
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
The process executes VB scripts
- cmd.exe (PID: 6508)
Connects to unusual port
- SwoYcckM.exe (PID: 6308)
- XWAQAQUE.exe (PID: 6352)
The process checks if it is being run in the virtual environment
- SwoYcckM.exe (PID: 6308)
INFO
Checks supported languages
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- XWAQAQUE.exe (PID: 6352)
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6660)
- SwoYcckM.exe (PID: 6308)
Creates files in the program directory
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- XWAQAQUE.exe (PID: 6352)
- SwoYcckM.exe (PID: 6308)
Reads the computer name
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- XWAQAQUE.exe (PID: 6352)
- SwoYcckM.exe (PID: 6308)
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6660)
Create files in a temporary directory
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6272)
- 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe (PID: 6660)
Creates files or folders in the user directory
- SwoYcckM.exe (PID: 6308)
Failed to create an executable file in Windows directory
- SwoYcckM.exe (PID: 6308)
Process checks computer location settings
- SwoYcckM.exe (PID: 6308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1970:01:01 00:02:03+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 5.12 |
| CodeSize: | 187392 |
| InitializedDataSize: | - |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2ca6e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
1 892
Monitored processes
15
Malicious processes
7
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6272 | "C:\Users\admin\Desktop\2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe" | C:\Users\admin\Desktop\2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6308 | "C:\Users\admin\lEMYkwoU\SwoYcckM.exe" | C:\Users\admin\lEMYkwoU\SwoYcckM.exe | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6352 | "C:\ProgramData\usAgAgoI\XWAQAQUE.exe" | C:\ProgramData\usAgAgoI\XWAQAQUE.exe | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6376 | C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\Desktop\2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock" | C:\Windows\SysWOW64\cmd.exe | — | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6440 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6460 | reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1 | C:\Windows\SysWOW64\reg.exe | — | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6468 | reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2 | C:\Windows\SysWOW64\reg.exe | — | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6476 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | reg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6484 | reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f | C:\Windows\SysWOW64\reg.exe | — | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6500 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | reg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 751
Read events
1 747
Write events
4
Delete events
0
Modification events
| (PID) Process: | (6272) 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | SwoYcckM.exe |
Value: C:\Users\admin\lEMYkwoU\SwoYcckM.exe | |||
| (PID) Process: | (6272) 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | XWAQAQUE.exe |
Value: C:\ProgramData\usAgAgoI\XWAQAQUE.exe | |||
| (PID) Process: | (6308) SwoYcckM.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | SwoYcckM.exe |
Value: C:\Users\admin\lEMYkwoU\SwoYcckM.exe | |||
| (PID) Process: | (6352) XWAQAQUE.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | XWAQAQUE.exe |
Value: C:\ProgramData\usAgAgoI\XWAQAQUE.exe | |||
Executable files
476
Suspicious files
0
Text files
133
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6272 | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | C:\Users\admin\AppData\Local\Temp\IagIEYAg.bat | text | |
MD5:BAE1095F340720D965898063FEDE1273 | SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A | |||
| 6308 | SwoYcckM.exe | C:\Users\admin\lEMYkwoU\SwoYcckM.inf | text | |
MD5:93F3F0912E7D86BA1E13C1F2EB596DCC | SHA256:35DD834B154999E8059AD3AB8F9EB3EC740D6E4B0AD75A6723CAB4E771579CA8 | |||
| 6272 | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | C:\Users\admin\Desktop\2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock | image | |
MD5:00974AAB6B9832933E8AC609E50E5DCE | SHA256:7E9997F40D13B32C724CA4ECEF283F377CE9965D31534167994E654D6E6623B6 | |||
| 6660 | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | C:\Users\admin\AppData\Local\Temp\BAwQEYAg.bat | text | |
MD5:B81C9E027D0188157262F5B37AEE8E55 | SHA256:4F155AAB23930F76103BBDABD7660332F07568430F9E5F37CC76A88C56011E88 | |||
| 6352 | XWAQAQUE.exe | C:\ProgramData\usAgAgoI\XWAQAQUE.inf | text | |
MD5:93F3F0912E7D86BA1E13C1F2EB596DCC | SHA256:35DD834B154999E8059AD3AB8F9EB3EC740D6E4B0AD75A6723CAB4E771579CA8 | |||
| 6508 | cmd.exe | C:\Users\admin\AppData\Local\Temp\file.vbs | text | |
MD5:4AFB5C4527091738FAF9CD4ADDF9D34E | SHA256:59D889A2BF392F4B117340832B4C73425A7FB1DE6C2F83A1AAA779D477C7C6CC | |||
| 6308 | SwoYcckM.exe | C:\Users\admin\Desktop\IEMm.exe | executable | |
MD5:D449D0966333D7A9B434CF71E5D0E5F1 | SHA256:3079DB5A7CB86249208C7BBC64D9607A7581F226101C6436AA9A187412AAA648 | |||
| 6308 | SwoYcckM.exe | C:\Users\admin\Desktop\AEIG.ico | image | |
MD5:8C44504BC8ECFA4C2D02F7668870EA6F | SHA256:C327C0485909F634C456CEA42F7DB6353FA4942EFE43A2C336D3932784C927ED | |||
| 6272 | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | C:\Users\admin\lEMYkwoU\SwoYcckM.exe | executable | |
MD5:987FABFD4857A704EE0D3F2EA495698A | SHA256:91E182982EFFA8ED4E82229A31FD3967616287B3047ED1AC604DDC087F388ADA | |||
| 6272 | 2025-01-26_370396745c1e9fb900795bb18b9ad279_virlock.exe | C:\ProgramData\usAgAgoI\XWAQAQUE.exe | executable | |
MD5:D1FF9A68C4B1F3A1D1770A23854057E5 | SHA256:D8A26701E2931183E065DF9C5E530DF33204B66BF30FBA3BF107DDD631CBEF62 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
29
DNS requests
6
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 184.30.25.170:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6308 | SwoYcckM.exe | GET | 301 | 172.217.16.142:80 | http://google.com/ | unknown | — | — | whitelisted |
6352 | XWAQAQUE.exe | GET | 301 | 172.217.16.142:80 | http://google.com/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 104.126.37.131:443 | — | Akamai International B.V. | DE | unknown |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.30.25.170:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6308 | SwoYcckM.exe | 200.87.164.69:9999 | — | Entel S.A. - EntelNet | BO | unknown |
6352 | XWAQAQUE.exe | 200.87.164.69:9999 | — | Entel S.A. - EntelNet | BO | unknown |
6352 | XWAQAQUE.exe | 172.217.16.142:80 | google.com | GOOGLE | US | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6352 | XWAQAQUE.exe | A Network Trojan was detected | ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check |
6308 | SwoYcckM.exe | A Network Trojan was detected | ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check |
6308 | SwoYcckM.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) |
6308 | SwoYcckM.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |
6352 | XWAQAQUE.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |
6308 | SwoYcckM.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |
6352 | XWAQAQUE.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |
6308 | SwoYcckM.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |
6352 | XWAQAQUE.exe | A Network Trojan was detected | RANSOMWARE [ANY.RUN] NSB Virlock.Gen Check-in |