c:\jenkins\workspace\Client\Client\Windows\release\bin\Release\CptService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_8089e8b358f391279741594ea139a8e1_avoslocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_8089e8b358f391279741594ea139a8e1_avoslocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_8089e8b358f391279741594ea139a8e1_avoslocker
-
Size
1.4MB
-
MD5
8089e8b358f391279741594ea139a8e1
-
SHA1
5634ab914dfb04b17d750d3fc2d4194160f5b0d6
-
SHA256
95931a43c595c23252ce8ff796e3d98afb32cc87667c96eff3cfafdfdf94c5c4
-
SHA512
5b1d2d179746ad2d2e8776a6f1d57a23253981eb3029b7e19980f4e6dd00f0472fd87218ed649717017f5d942cebf828e45d2fbc2a79cd54fb5572f14b326e0c
-
SSDEEP
24576:WZR0X09MC659AsqjnhMgeiCl7G0nehbGZpbD:GR0X09MNn8Dmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-05-24_8089e8b358f391279741594ea139a8e1_avoslocker
Files
-
2024-05-24_8089e8b358f391279741594ea139a8e1_avoslocker.exe windows:6 windows x86 arch:x86
5cba1e09bd336270ce80274dfaecadee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
DeleteFileW
GetFullPathNameW
SetLastError
CopyFileW
MoveFileW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
GetFileSize
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
TerminateThread
ResumeThread
SetEndOfFile
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FreeLibrary
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
GetModuleFileNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleA
LoadLibraryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetExitCodeThread
GetVersionExW
GetSystemInfo
TerminateProcess
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
MultiByteToWideChar
FileTimeToSystemTime
lstrcpyW
lstrcmpA
LocalFree
LocalAlloc
GetLocalTime
GetFileAttributesW
FileTimeToLocalFileTime
WideCharToMultiByte
GetCurrentProcessId
DeleteCriticalSection
DecodePointer
RaiseException
CloseHandle
SetEvent
GetLastError
ProcessIdToSessionId
CreateEventW
OpenProcess
LCMapStringW
GetFileType
WriteFile
GetStdHandle
ExitProcess
ReadFile
GetFileAttributesExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
CreateFileW
WaitForSingleObject
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetCommandLineW
EnterCriticalSection
GetCPInfo
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
OutputDebugStringW
IsDebuggerPresent
WriteConsoleW
user32
GetSystemMetrics
advapi32
SetSecurityDescriptorDacl
SetServiceStatus
RegisterServiceCtrlHandlerExW
OpenProcessToken
AllocateAndInitializeSid
FreeSid
GetTokenInformation
InitializeSecurityDescriptor
ConvertStringSidToSidW
QueryServiceStatusEx
QueryServiceConfigW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
CreateProcessAsUserW
SetEntriesInAclW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
StartServiceCtrlDispatcherW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
shlwapi
PathRemoveFileSpecW
PathAppendW
PathIsRelativeW
PathFindFileNameW
PathFileExistsW
crypt32
CryptMsgGetParam
CertCloseStore
CryptDecodeObject
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertFindCertificateInStore
CryptMsgClose
wintrust
WinVerifyTrust
rpcrt4
I_RpcBindingInqLocalClientPID
NdrServerCall2
RpcBindingFree
RpcServerUseProtseqEpW
RpcServerUnregisterIfEx
RpcServerRegisterIf2
psapi
GetProcessImageFileNameA
GetProcessImageFileNameW
GetModuleFileNameExW
version
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE