avoslocker | 6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2

Resubmissions

07-04-2024 09:24

240407-ldfr1sab77 10

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
Size

919KB
MD5

40f2238875fcbd2a92cfefc4846a15a8
SHA1

06dce6a5df6ee0099602863a47e2cdeea4e34764
SHA256

6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2
SHA512

8ab1a2124a67e91a4e1842b5f600f977d3d72d398b64ee690c297a04b733e60e01fe4383a1fdf25bb412bc1294d69c5402bd60159c3125bdfb709d024c8e04b8
SSDEEP

24576:ID7x8JDwepWTu/g6YvOkAT5OdAP6tfKf2J9lb:Ifx8JDwepWaOvOkANOdS6BT9V

Score

10^/10

avoslocker ransomware

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\GET_YOUR_FILES_BACK.txt

Family

avoslocker

Ransom Note

Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Your ID: 08604a3c44a32c3c2a51182916c1de99605478319605c31f1215e6109c01f9db

URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion

http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Renames multiple (192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe
Token: SeShutdownPrivilege	2140	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe
2140	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3020	2140	chrome.exe	33
PID 2140 wrote to memory of 3020	2140	chrome.exe	33
PID 2140 wrote to memory of 3020	2140	chrome.exe	33
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2408	2140	chrome.exe	35
PID 2140 wrote to memory of 2920	2140	chrome.exe	36
PID 2140 wrote to memory of 2920	2140	chrome.exe	36
PID 2140 wrote to memory of 2920	2140	chrome.exe	36
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37
PID 2140 wrote to memory of 1580	2140	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
"C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe"
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d49758,0x7fef6d49768,0x7fef6d49778
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1032 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1160 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3324 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3704 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 --field-trial-handle=1392,i,10009515224651341328,18138022025760624316,131072 /prefetch:8
  2⤵
  PID:1760

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0772df39-5661-453d-9e80-021f215e9042.tmp

Filesize
264KB

MD5
a359c1c9508c2e8d96d99fcc91fcbbe6

SHA1
0c41deba60d933951e1314737d63449979c3cd02

SHA256
b447b8b72b7840c22dd85e838081b01acd45e50bd70088be8bccc7f5c7dfd0ae

SHA512
57e1554e40d29422293c5383af9aec5dbacf9cdd6916fcd1563a32f329cdd519264f3f827a4582c426700a4438ecaa59600f05c1ee2b852f4df4446705ed83c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
207e9ee8ca99c51071b02c7e27291f81

SHA1
9e3a6f28e716b96337546a6f9ffac511d63b05c2

SHA256
91d2baae8688c742f3b9815570481ba8deb6dd1e17b86af689f094bc08e63dd1

SHA512
d7488b30b63f648bde7ca2ca5440dc36b6f05be4b69514e69a2db07657a777af6a8629dc378aa95807097840d9d1e7e22d420e53ca4d25991b94632f4f1bc6b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
e8f82e147bbe690c45ca06f92aa3c7f0

SHA1
f17b7fb9886e936654672fed38b7c4bd3a04a76a

SHA256
c1dec31c02e5c8a6d16fc33bf919c1a6a068bf66ad6427d648d62c49072f8729

SHA512
9e0976edf93c5b61d9affe8cec4e7728e23a9660f483a4274a79ad191d8b632901d2f9d01445cb4b730b586c4e84afff50d660707c4fb7c19a25702b5a25aaf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
264KB

MD5
2ab2f038765056b520c3f28643fa469e

SHA1
213c7ce2e93b75d931a8f5877a826b76e9401ca2

SHA256
36b36602464a871261298d74a35d2d579d6b540c9745fec06da9e778e3cc2b2a

SHA512
288000a33ffa3d6075df0ca23eb55fb37dd71d55a16087245dd1fb5218b7817c29ff31547c459d6c500d16af6f4dbc4a3a53bb3147f7c10096f92e6a10d816d5

Download Submit
F:\$RECYCLE.BIN\GET_YOUR_FILES_BACK.txt

Filesize
1KB

MD5
651c844ad8ffea0473fc70cc13ff2e47

SHA1
f904db3a0e77df893d39cb41fe4297589db82459

SHA256
f55ec710e56442344196f3612207118d89f877a79a6f8028db520631ace0fa0b

SHA512
91ca8247d673d8381ca5edc394e86956844218ae291e20480817a5a93ae6e4573af419e3d571815030a375de16e85fd5ec7693331aa6753fe07b88e15701fcae

Download Submit