7edd555debf7be5e85b56d3092b236182dd5e2c76f9766e3bf845ef1e594ed06

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:25

Target

2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe
Size

6.5MB
MD5

ca12c2172794e8079a1069890841a372
SHA1

3b24152506052d466f1ecee6db8fa3ce596f6aa9
SHA256

7edd555debf7be5e85b56d3092b236182dd5e2c76f9766e3bf845ef1e594ed06
SHA512

2465cc2659672f97c163757e77e35304b05f5dfd930b180b45eea8a01d21f7430a73584b65fa47b2fb07dbc71ff2cb0a294fde93a11066385e88b0fc6a858433
SSDEEP

98304:ZI9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:ZAH6aff4+4p84yjRyBNxqQ

Score

8^/10

discovery

Drops file in Drivers directory 1 IoCs

Processes:

2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe

Executes dropped EXE 1 IoCs

Processes:

5fb4015febad475ca1c14a6534874118.exe

pid process

1028 5fb4015febad475ca1c14a6534874118.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1028	5fb4015febad475ca1c14a6534874118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe

description	pid	process	target process
PID 2328 wrote to memory of 1028	2328	2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe	5fb4015febad475ca1c14a6534874118.exe
PID 2328 wrote to memory of 1028	2328	2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe	5fb4015febad475ca1c14a6534874118.exe
PID 2328 wrote to memory of 1028	2328	2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe	5fb4015febad475ca1c14a6534874118.exe
PID 2328 wrote to memory of 1028	2328	2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe	5fb4015febad475ca1c14a6534874118.exe

C:\Users\Admin\AppData\Local\Temp\5fb4015febad475ca1c14a6534874118.exe
"C:\Users\Admin\AppData\Local\Temp\5fb4015febad475ca1c14a6534874118.exe" --01
2⤵
- Executes dropped EXE
PID:1028

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\5fb4015febad475ca1c14a6534874118.exe

Filesize
6.0MB

MD5
02e6bf47f5315e8da515ccae63f58a6e

SHA1
3469eec2964080610b188eceabc216a5f0244d2b

SHA256
aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

SHA512
949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

Download Submit
memory/2328-0-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

Filesize
4KB

Download
memory/2328-1-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2328-2-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2328-3-0x0000000000A80000-0x0000000000AAE000-memory.dmp

Filesize
184KB

Download
memory/2328-4-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/2328-11-0x00000000007E0000-0x00000000007F0000-memory.dmp

Filesize
64KB

Download
memory/2328-12-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download