Overview

overview

3

Static

static

3

2024-05-23...er.exe

windows7-x64

3

2024-05-23...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 00:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_cf72c37a5c83391ac991f9b14db6b1cd_avoslocker.exe

  • Size

    7.4MB

  • MD5

    cf72c37a5c83391ac991f9b14db6b1cd

  • SHA1

    6bd57c396230af421fb10d25e0319903e861f685

  • SHA256

    7508a37a24f295c7a9bcb9b31a497a269f143ed4bea85f9a8c329c1c24392e98

  • SHA512

    37cc7ce3f75b9af0a4f7d40f3c8697b01aef89017fb9b85129906dc8ac14bdd118a5f688e045d7f81518ae0fb43dc9e90b56a6edbe20c0a46b2376fa34931516

  • SSDEEP

    98304:U4h5PfhefTAv8HM2JyiFpK6FR4FBm21BgdKqyyhab0Ab:x5PfhoAUs2JyEYxBajc

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_cf72c37a5c83391ac991f9b14db6b1cd_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_cf72c37a5c83391ac991f9b14db6b1cd_avoslocker.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 2512
      2⤵
      • Program crash
      PID:4932
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3452 -ip 3452
    1⤵
      PID:4924

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\{A2029B0E-3E7A-4103-B3CC-F55B52DF9E11}\CCDInstaller.js
      Filesize

      1.2MB

      MD5

      fbc34da120e8a3ad11b3ad1404b6c51a

      SHA1

      fe3e36de12e0bdd0a7731e572e862c50ee89207c

      SHA256

      9701b3ba335b5a11be32dd63ea3a466a14e048c1e5881cac81352b459be0f202

      SHA512

      f3f0452d16a7cd0600a8ffced5167783d3f31e51dce512872ade5031c97b14366af0343bfe2c822c8ac4a281f27f5eeb00fe7d0e8cbe90434f79bacf3ecb42d2

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\{A2029B0E-3E7A-4103-B3CC-F55B52DF9E11}\index.html
      Filesize

      426B

      MD5

      a28ab17b18ff254173dfeef03245efd0

      SHA1

      c6ce20924565644601d4e0dd0fba9dde8dea5c77

      SHA256

      886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

      SHA512

      9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

      Download Submit