Analysis

  • max time kernel
    97s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 20:22

General

  • Target

    2024-06-21_6d6858759591cf6f0abd046f863e06e6_avoslocker_magniber_metamorfo.exe

  • Size

    14.3MB

  • MD5

    6d6858759591cf6f0abd046f863e06e6

  • SHA1

    c178d950707f41922ada92e457adc6cda7033d69

  • SHA256

    a3166d2e7e2b053db93cf8336720fb9b75bc9d012e1c22782792c9bc890b01de

  • SHA512

    64a7135b180effff541976eb5e622060d8d94707f40c05cfa657344f9e961499965767477eef2c2e05d80f2659d41fa86fcd66c45522b5520b040caed25269ea

  • SSDEEP

    393216:StHLVy12S9tbV6PHxIWCEA34Z8m8KbO/rqNU/GX+on:StHLVycS9tbV6PHxIWCEK4fO7/GX

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-21_6d6858759591cf6f0abd046f863e06e6_avoslocker_magniber_metamorfo.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-21_6d6858759591cf6f0abd046f863e06e6_avoslocker_magniber_metamorfo.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\PDF Suite 20\Installation\PlayaSDK\PlayaSDK.dll

    Filesize

    960KB

    MD5

    11a813c0972b740937d3a7e2daf9ffcb

    SHA1

    4245b5a3c97f725c56a29d745767edebb5e3f15d

    SHA256

    3f933bced2d9f65d48f7c48715bf286fd431341a74e1ce15d39b7c4c96603cf9

    SHA512

    9a590dcab0cf7051d04743736ea7a6b74fa0f87539580cc41a58ad33a76574201e7b6d54d5100cbcd262266bc55b053243edd4860a2d43deeb1c164395e4a941