48fc6f1b33e6213bd6d9aefd24bb9ef4e624233f74353eee9dff8e4f15e5c61b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:55

Target

2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe
Size

6.5MB
MD5

80071282ed477e2fa4a1c81c0473894f
SHA1

19096d26bf7ab42cf9925fb130fc3366de04febb
SHA256

48fc6f1b33e6213bd6d9aefd24bb9ef4e624233f74353eee9dff8e4f15e5c61b
SHA512

f75aa770deaad453089b831d00a71eab4d60e077a1e6fcf8fab1ba7fb173002fd21b6020f487ef3e8e5d17d88e8ea6d4fd3f776c097e8bb447a8c1e8afdb9584
SSDEEP

98304:1I9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:1AH6aff4+4p84yjRyBNxqQ

Score

8^/10

discovery

Drops file in Drivers directory 1 IoCs

Processes:

2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe

Executes dropped EXE 1 IoCs

Processes:

53c87412a663413387f6815029ac1a4b.exe

pid process

3064 53c87412a663413387f6815029ac1a4b.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3064	53c87412a663413387f6815029ac1a4b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe

description	pid	process	target process
PID 1704 wrote to memory of 3064	1704	2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe	53c87412a663413387f6815029ac1a4b.exe
PID 1704 wrote to memory of 3064	1704	2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe	53c87412a663413387f6815029ac1a4b.exe
PID 1704 wrote to memory of 3064	1704	2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe	53c87412a663413387f6815029ac1a4b.exe
PID 1704 wrote to memory of 3064	1704	2024-05-22_80071282ed477e2fa4a1c81c0473894f_avoslocker_revil.exe	53c87412a663413387f6815029ac1a4b.exe

C:\Users\Admin\AppData\Local\Temp\53c87412a663413387f6815029ac1a4b.exe
"C:\Users\Admin\AppData\Local\Temp\53c87412a663413387f6815029ac1a4b.exe" --01
2⤵
- Executes dropped EXE
PID:3064

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\53c87412a663413387f6815029ac1a4b.exe

Filesize
6.0MB

MD5
02e6bf47f5315e8da515ccae63f58a6e

SHA1
3469eec2964080610b188eceabc216a5f0244d2b

SHA256
aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

SHA512
949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

Download Submit
memory/1704-0-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/1704-2-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/1704-3-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/1704-4-0x000000001B710000-0x000000001B73E000-memory.dmp

Filesize
184KB

Download
memory/1704-5-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/1704-12-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1704-13-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download