5a7c6e60684271c51bdfd0b2eebd512aae8d09260d01dc3942bb4451d79fc868

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:28

Target

2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe
Size

6.5MB
MD5

07d9dff29a09b0b92581d277ab136db8
SHA1

3b1e84b4dc02f5c36586e4956c405c5580e446a4
SHA256

5a7c6e60684271c51bdfd0b2eebd512aae8d09260d01dc3942bb4451d79fc868
SHA512

9f89969ebd8d7571fcfbc2a72438b5e2c9471304e98fff2beb1545d5a1768c7c0ab3d84b47299a7e2a1ad7cf7102853ae4582622ac23c8c5f8a4ffa181c85650
SSDEEP

98304:7I9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:7AH6aff4+4p84yjRyBNxqQ

Score

8^/10

discovery

Drops file in Drivers directory 1 IoCs

Processes:

2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe

Executes dropped EXE 1 IoCs

Processes:

ce54b0adf901465cb31bb87c7c270c34.exe

pid process

2348 ce54b0adf901465cb31bb87c7c270c34.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2348	ce54b0adf901465cb31bb87c7c270c34.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe

description	pid	process	target process
PID 1232 wrote to memory of 2348	1232	2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe	ce54b0adf901465cb31bb87c7c270c34.exe
PID 1232 wrote to memory of 2348	1232	2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe	ce54b0adf901465cb31bb87c7c270c34.exe
PID 1232 wrote to memory of 2348	1232	2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe	ce54b0adf901465cb31bb87c7c270c34.exe
PID 1232 wrote to memory of 2348	1232	2024-05-22_07d9dff29a09b0b92581d277ab136db8_avoslocker_revil.exe	ce54b0adf901465cb31bb87c7c270c34.exe

C:\Users\Admin\AppData\Local\Temp\ce54b0adf901465cb31bb87c7c270c34.exe
"C:\Users\Admin\AppData\Local\Temp\ce54b0adf901465cb31bb87c7c270c34.exe" --01
2⤵
- Executes dropped EXE
PID:2348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\ce54b0adf901465cb31bb87c7c270c34.exe

Filesize
6.0MB

MD5
02e6bf47f5315e8da515ccae63f58a6e

SHA1
3469eec2964080610b188eceabc216a5f0244d2b

SHA256
aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

SHA512
949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

Download Submit
memory/1232-0-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download
memory/1232-1-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/1232-2-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/1232-3-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/1232-4-0x0000000000770000-0x000000000079E000-memory.dmp

Filesize
184KB

Download
memory/1232-5-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/1232-12-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/1232-13-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download