Analysis
-
max time kernel
125s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe
-
Size
5.5MB
-
MD5
374f077b74762d300c35b62947d9738e
-
SHA1
316f2577ac4e911543fc6fc1279034952d5f0f84
-
SHA256
45ee781e271d0483d777a55544ccd44a9490ad26f533dc89816c068adb61ccb6
-
SHA512
dc580db7a7d2cf4c4d3b24e5375762048d6feddd00f3201b7f2236634b6c5d909f6833056a82a318b15876a28de2aafa22e8e0d99c2960d1a3e15a02972dc60b
-
SSDEEP
98304:3eF0/sAT4mGfckjASn3ZCto1N1BpxgTuiN54AR6K8OU/ha27:sSsATN+V3k0pxMkAR8ZN
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exedescription ioc process File opened for modification \??\PhysicalDrive0 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe -
Processes:
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\FlightRoot 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\TrustedDevices 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\TestSignRoot 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exepid process 744 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe 744 2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_374f077b74762d300c35b62947d9738e_avoslocker_magniber_revil.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:744