c4cfa3190d1e0ee8cbebe820c1935e505ee0d8028cee3a4144fbc226e0017e55

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:56

Target
2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe
Size 21.3MB
Sample240529-kwer1aaa86
SHA256 c4cfa3190d1e0ee8cbebe820c1935e505ee0d8028cee3a4144fbc226e0017e55
MD5 cb464a4d3ddbdc5037791ac31c866e5c
SHA1 59995bdbb4dbb7a71faa75da0253660da140b50d
SHA512 8c72fc0fd2568c4c255215ea98fafd59c8d0e591485d331d730cf5fbeac10a5d7a9a9b83725e98514a9810aa0276fa402a80d73b0cfc6a4a2eb6ca80740ce34c
SSDEEP 196608:wCfsQRc4Zkr+K6SHULTHpFnsVufrqNVaUQGX8XCS1gJy5zd:wFUarEJhsofrqN0/GX8T13
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}	2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-29_cb464a4d3ddbdc5037791ac31c866e5c_avoslocker_metamorfo_revil.exe"
1⤵
- Modifies registry class
PID:4532