Analysis
-
max time kernel
99s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe
-
Size
5.3MB
-
MD5
3fa4e44540dfc91f042fe1c4fdc210af
-
SHA1
209c783115e0e93594524cebbd1554fbca2ceb15
-
SHA256
5a8aaed11908cccbee2b2eed0b4eed11412edb052b73461898fa30d8c6ddeacd
-
SHA512
801371be7d66465341914a86140a26c4ffd88b4300c832eee0e6e15a17dec3c456620c4158dddb03fcfbf8561be9677f2fe90282ab496e45a12d944fe620cdf1
-
SSDEEP
98304:LVrv78HEFfNHX5rpiD0BTa3aLkBo6DjD7d/TLCQlv:LwEFfHp7B2NDjD7d3CQ1
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
Processes:
2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_fa.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_ne.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_lv.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_zh-TW.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\skchui.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libsmartscreen.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_gu.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_kk.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_lb.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_pt-PT.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_ka.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PowerShell.PackageManagement.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libEGL.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_fil.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psuser.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msvcp140.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_nl.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Internet Explorer\sqmapi.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PowerShell.PackageManagement.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PackageManagement.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt40.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\microsoft_apis.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_sw.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_as.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF64.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkObj.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaer.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.ArchiverProviders.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIB.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_gd.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_sk.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libGLESv2.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Acrofx32.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_ca.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\rtscom.dll 2024-05-23_3fa4e44540dfc91f042fe1c4fdc210af_avoslocker.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD53fa4e44540dfc91f042fe1c4fdc210af
SHA1209c783115e0e93594524cebbd1554fbca2ceb15
SHA2565a8aaed11908cccbee2b2eed0b4eed11412edb052b73461898fa30d8c6ddeacd
SHA512801371be7d66465341914a86140a26c4ffd88b4300c832eee0e6e15a17dec3c456620c4158dddb03fcfbf8561be9677f2fe90282ab496e45a12d944fe620cdf1