da9725d157e88b0ec3d7aa36ee0093dea859273922017af44b091ad692bb67ba

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:48

Target

2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe
Size

6.5MB
MD5

707dcb12658071e81c002a208de3c91e
SHA1

8398ad3a71188f6f530de0e426acb4246be56c0e
SHA256

da9725d157e88b0ec3d7aa36ee0093dea859273922017af44b091ad692bb67ba
SHA512

6588cf2b79e50bb9df6e753394c5f1e87b6a1d57b2070a46c121c0439abfbee47b09d327ad833a567b63ba17250fff851e96ad4c44415579e94dddb75e346a19
SSDEEP

98304:wI9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:wAH6aff4+4p84yjRyBNxqQ

Score

8^/10

discovery

Drops file in Drivers directory 1 IoCs

Processes:

2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe

Executes dropped EXE 1 IoCs

Processes:

2c1f56cb62974be78dd30a03e7fbe8db.exe

pid process

1800 2c1f56cb62974be78dd30a03e7fbe8db.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1800	2c1f56cb62974be78dd30a03e7fbe8db.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe

description	pid	process	target process
PID 2408 wrote to memory of 1800	2408	2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe	2c1f56cb62974be78dd30a03e7fbe8db.exe
PID 2408 wrote to memory of 1800	2408	2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe	2c1f56cb62974be78dd30a03e7fbe8db.exe
PID 2408 wrote to memory of 1800	2408	2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe	2c1f56cb62974be78dd30a03e7fbe8db.exe
PID 2408 wrote to memory of 1800	2408	2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe	2c1f56cb62974be78dd30a03e7fbe8db.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_707dcb12658071e81c002a208de3c91e_avoslocker_revil.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\2c1f56cb62974be78dd30a03e7fbe8db.exe
  "C:\Users\Admin\AppData\Local\Temp\2c1f56cb62974be78dd30a03e7fbe8db.exe" --01
  2⤵
  - Executes dropped EXE
  PID:1800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\2c1f56cb62974be78dd30a03e7fbe8db.exe

Filesize
6.0MB

MD5
02e6bf47f5315e8da515ccae63f58a6e

SHA1
3469eec2964080610b188eceabc216a5f0244d2b

SHA256
aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

SHA512
949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

Download Submit
memory/2408-0-0x000007FEF4F6E000-0x000007FEF4F6F000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x000007FEF4CB0000-0x000007FEF564D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-2-0x000007FEF4CB0000-0x000007FEF564D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-3-0x00000000028C0000-0x00000000028EE000-memory.dmp

Filesize
184KB

Download
memory/2408-4-0x0000000000910000-0x000000000091A000-memory.dmp

Filesize
40KB

Download
memory/2408-11-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/2408-12-0x000007FEF4CB0000-0x000007FEF564D000-memory.dmp

Filesize
9.6MB

Download