Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 14:52

General

  • Target

    2024-06-18_7c345a3408d0555cdaead86fa4955a09_avoslocker_cobalt-strike_metamorfo.exe

  • Size

    375KB

  • MD5

    7c345a3408d0555cdaead86fa4955a09

  • SHA1

    6aa9adbadc0508361a1db78afccff6a9a5ffa54c

  • SHA256

    6826b60fcf9993178042f62c206c54a2ace4f8c114dbdd94601db464d6f16a59

  • SHA512

    42503ca6019784623f8b7f9d2b74c68dd2bc17da5cbeaa93170f900a882688c9039cb50a8a3dda4c1714bc418a9ae2d8f7d59eace28913354c67bcc965c4dbcf

  • SSDEEP

    6144:mQ91dwpFilh+CQn2TtWga+1hPRvxRaR9bYLw5L/04N:mQ94pFilh+CQ2La+RiNh/04N

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-18_7c345a3408d0555cdaead86fa4955a09_avoslocker_cobalt-strike_metamorfo.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-18_7c345a3408d0555cdaead86fa4955a09_avoslocker_cobalt-strike_metamorfo.exe"
    1⤵
      PID:1668
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://zoom.us/support/down4j?os=win&err=20030003&v=2_6_1
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2652

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1668-0-0x0000000000340000-0x0000000000342000-memory.dmp
      Filesize

      8KB