Overview

overview

3

Static

static

3

2024-05-05...er.exe

windows7-x64

3

2024-05-05...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    133s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2024, 00:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-05_a0362f2672469d05965c4a1c1fb6fcbe_avoslocker.exe

  • Size

    7.4MB

  • MD5

    a0362f2672469d05965c4a1c1fb6fcbe

  • SHA1

    b1e02b82ddf6744dfb81dc02d77269a4fc6558ec

  • SHA256

    8e0a4b78bb374e20694d8b686e2ec6c4a28a85dcd4de163e3126912906559e9e

  • SHA512

    9d2300ff5665713de371f0ba51922400ee3ddfaadbef1a4f36ad237e57ebebc7b22de30d5e7b054a3f667b697a5ced3f3144c29a269ffff36a2a8d8a68c135ad

  • SSDEEP

    98304:G4h5PfhefTAv8HM2JyiFpK6FR4FBm21BgdKqyyIab0AzV:j5PfhoAUs2JyEYxBnjIV

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-05_a0362f2672469d05965c4a1c1fb6fcbe_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-05_a0362f2672469d05965c4a1c1fb6fcbe_avoslocker.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 2508
      2⤵
      • Program crash
      PID:4656
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 2532
      2⤵
      • Program crash
      PID:1736
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3376 -ip 3376
    1⤵
      PID:1800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3376 -ip 3376
      1⤵
        PID:2484

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\{38F4D710-0CA1-409E-BA90-47C817A41486}\CCDInstaller.js
        Filesize

        1.2MB

        MD5

        fbc34da120e8a3ad11b3ad1404b6c51a

        SHA1

        fe3e36de12e0bdd0a7731e572e862c50ee89207c

        SHA256

        9701b3ba335b5a11be32dd63ea3a466a14e048c1e5881cac81352b459be0f202

        SHA512

        f3f0452d16a7cd0600a8ffced5167783d3f31e51dce512872ade5031c97b14366af0343bfe2c822c8ac4a281f27f5eeb00fe7d0e8cbe90434f79bacf3ecb42d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{38F4D710-0CA1-409E-BA90-47C817A41486}\index.html
        Filesize

        426B

        MD5

        a28ab17b18ff254173dfeef03245efd0

        SHA1

        c6ce20924565644601d4e0dd0fba9dde8dea5c77

        SHA256

        886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

        SHA512

        9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

        Download Submit