Analysis
-
max time kernel
91s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe
-
Size
6.5MB
-
MD5
ca12c2172794e8079a1069890841a372
-
SHA1
3b24152506052d466f1ecee6db8fa3ce596f6aa9
-
SHA256
7edd555debf7be5e85b56d3092b236182dd5e2c76f9766e3bf845ef1e594ed06
-
SHA512
2465cc2659672f97c163757e77e35304b05f5dfd930b180b45eea8a01d21f7430a73584b65fa47b2fb07dbc71ff2cb0a294fde93a11066385e88b0fc6a858433
-
SSDEEP
98304:ZI9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:ZAH6aff4+4p84yjRyBNxqQ
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe -
Executes dropped EXE 1 IoCs
Processes:
a3cb133251be41a8804d8ebead58c001.exepid process 3708 a3cb133251be41a8804d8ebead58c001.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe File opened for modification C:\Windows\assembly\Desktop.ini 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe -
Drops file in Windows directory 3 IoCs
Processes:
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exedescription ioc process File opened for modification C:\Windows\assembly 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe File created C:\Windows\assembly\Desktop.ini 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe File opened for modification C:\Windows\assembly\Desktop.ini 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exedescription pid process target process PID 2160 wrote to memory of 3708 2160 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe a3cb133251be41a8804d8ebead58c001.exe PID 2160 wrote to memory of 3708 2160 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe a3cb133251be41a8804d8ebead58c001.exe PID 2160 wrote to memory of 3708 2160 2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe a3cb133251be41a8804d8ebead58c001.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ca12c2172794e8079a1069890841a372_avoslocker_revil.exe"1⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3cb133251be41a8804d8ebead58c001.exe"C:\Users\Admin\AppData\Local\Temp\a3cb133251be41a8804d8ebead58c001.exe" --012⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a3cb133251be41a8804d8ebead58c001.exeFilesize
6.0MB
MD502e6bf47f5315e8da515ccae63f58a6e
SHA13469eec2964080610b188eceabc216a5f0244d2b
SHA256aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517
SHA512949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031
-
memory/2160-6-0x000000001D050000-0x000000001D07E000-memory.dmpFilesize
184KB
-
memory/2160-2-0x000000001C890000-0x000000001CD5E000-memory.dmpFilesize
4.8MB
-
memory/2160-3-0x000000001CE00000-0x000000001CE9C000-memory.dmpFilesize
624KB
-
memory/2160-4-0x00007FFD856A0000-0x00007FFD86041000-memory.dmpFilesize
9.6MB
-
memory/2160-5-0x0000000002030000-0x0000000002038000-memory.dmpFilesize
32KB
-
memory/2160-0-0x00007FFD85955000-0x00007FFD85956000-memory.dmpFilesize
4KB
-
memory/2160-9-0x000000001D040000-0x000000001D04A000-memory.dmpFilesize
40KB
-
memory/2160-1-0x00007FFD856A0000-0x00007FFD86041000-memory.dmpFilesize
9.6MB
-
memory/2160-13-0x00007FFD856A0000-0x00007FFD86041000-memory.dmpFilesize
9.6MB
-
memory/2160-16-0x000000001CF00000-0x000000001CF10000-memory.dmpFilesize
64KB
-
memory/2160-17-0x000000001EC80000-0x000000001ECA0000-memory.dmpFilesize
128KB
-
memory/2160-18-0x000000001ECF0000-0x000000001ED08000-memory.dmpFilesize
96KB
-
memory/2160-20-0x00007FFD856A0000-0x00007FFD86041000-memory.dmpFilesize
9.6MB