Overview
overview
10Static
static
1014-11-2023...1D.rar
windows10-1703-x64
3AveryNuker...DME.md
windows10-1703-x64
3AveryNuker...IS.bat
windows10-1703-x64
10AveryNuker...ry.exe
windows10-1703-x64
7avery.pyc
windows10-1703-x64
3AveryNuker...ls.txt
windows10-1703-x64
1AveryNuker...rs.txt
windows10-1703-x64
1AveryNuker...es.txt
windows10-1703-x64
1AveryNuker...ry.exe
windows10-1703-x64
10AveryNuker...ery.py
windows10-1703-x64
3Analysis
-
max time kernel
315s -
max time network
1591s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
14-11-2023 09:38
Behavioral task
behavioral1
Sample
14-11-2023_VUBSUFEkriWDh1D.rar
Resource
win10-20231023-en
Behavioral task
behavioral2
Sample
AveryNuker-main/README.md
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
AveryNuker-main/RUN THIS.bat
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
AveryNuker-main/Scraped/avery.exe
Resource
win10-20231020-en
Behavioral task
behavioral5
Sample
avery.pyc
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
AveryNuker-main/Scraped/channels.txt
Resource
win10-20231023-en
Behavioral task
behavioral7
Sample
AveryNuker-main/Scraped/members.txt
Resource
win10-20231020-en
Behavioral task
behavioral8
Sample
AveryNuker-main/Scraped/roles.txt
Resource
win10-20231020-en
Behavioral task
behavioral9
Sample
AveryNuker-main/avery.exe
Resource
win10-20231025-en
Behavioral task
behavioral10
Sample
AveryNuker-main/avery.py
Resource
win10-20231023-en
General
-
Target
AveryNuker-main/avery.py
-
Size
17KB
-
MD5
f7f34aad4e7521d7e4358abfa3f6f715
-
SHA1
dfc0b706cfe3e634a56d7c06be2efca5a3cabfa7
-
SHA256
d8b1d13e052ad38bd7e88f325d94aaf8ca245d96fa310545cb6d618ab1ab4d7d
-
SHA512
0c5d9e34479a1d1bfff7117dfc943c84882e26beb5a26bdfc8e79f1309179428fe40e1ea2aa65f94006be9725f98b6c0ac372b8cad1d6803129d2ae5cb65cdb6
-
SSDEEP
192:ADhumGIrgD51a3de6kklVkpK6/fB/dzB0po2E/4/Jll71JQj5fh81JhT8c0ONsEZ:ADhumGz543Q6kell71JQhh81JhLNso
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3556 OpenWith.exe