0847f972e4be0c16d83cb8f58688f2aa6dcb8aef9b3909755a93f435c771900e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:29

Target

2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe
Size

6.5MB
MD5

d688c21c548c567c46ec5fe585fd34f6
SHA1

9352a95b0e887419f939ad3ada326652cc410543
SHA256

0847f972e4be0c16d83cb8f58688f2aa6dcb8aef9b3909755a93f435c771900e
SHA512

0489dd0142d959fc9764612d0f9bffd5fea98a6e36daa08447b4439097360cc9dadb1c4ae45c6644cb5f4e8feb09033e7ae4cd0fa165b465c0a2e959e247e340
SSDEEP

98304:+I9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQ:+AH6aff4+4p84yjRyBNxqQ

Score

8^/10

discovery

Drops file in Drivers directory 1 IoCs

Processes:

2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe

Executes dropped EXE 1 IoCs

Processes:

088a08df3ce242acb2197d6bec828580.exe

pid process

2428 088a08df3ce242acb2197d6bec828580.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2428	088a08df3ce242acb2197d6bec828580.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe

description	pid	process	target process
PID 3008 wrote to memory of 2428	3008	2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe	088a08df3ce242acb2197d6bec828580.exe
PID 3008 wrote to memory of 2428	3008	2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe	088a08df3ce242acb2197d6bec828580.exe
PID 3008 wrote to memory of 2428	3008	2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe	088a08df3ce242acb2197d6bec828580.exe
PID 3008 wrote to memory of 2428	3008	2024-05-22_d688c21c548c567c46ec5fe585fd34f6_avoslocker_revil.exe	088a08df3ce242acb2197d6bec828580.exe

C:\Users\Admin\AppData\Local\Temp\088a08df3ce242acb2197d6bec828580.exe
"C:\Users\Admin\AppData\Local\Temp\088a08df3ce242acb2197d6bec828580.exe" --01
2⤵
- Executes dropped EXE
PID:2428

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\088a08df3ce242acb2197d6bec828580.exe

Filesize
6.0MB

MD5
02e6bf47f5315e8da515ccae63f58a6e

SHA1
3469eec2964080610b188eceabc216a5f0244d2b

SHA256
aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517

SHA512
949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031

Download Submit
memory/3008-0-0x000007FEF567E000-0x000007FEF567F000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-2-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-3-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

Filesize
9.6MB

Download
memory/3008-4-0x0000000002880000-0x00000000028AE000-memory.dmp

Filesize
184KB

Download
memory/3008-5-0x0000000000920000-0x000000000092A000-memory.dmp

Filesize
40KB

Download
memory/3008-12-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/3008-13-0x000007FEF53C0000-0x000007FEF5D5D000-memory.dmp

Filesize
9.6MB

Download