Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
10-07-2024 10:38
General
-
Target
2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe
-
Size
4.3MB
-
MD5
b0a674f3e540801c827953089e6c9f03
-
SHA1
d0fbeb2bf51324360835e51b80ae0df4f80c760c
-
SHA256
c14db4f709fa70fb70c7f3969cee4177d2641c098e06b1909af77e09addfa64f
-
SHA512
fc2132048a7f8b25ca31e1f3f9a570124834a80633ad5b867513a73e87187c0ce2c2bf6cca1337ba468f3bc45c4c14bbf5d9ba39584ba3aa9d3b1e615a453afc
-
SSDEEP
98304:dpq/d8kCBwlMyQjujDW9tBcg2jGqwwAqWFnhGJ98j02rSYC6dkB3tiXFR:ecP5ujyp8jGqwwtanagrRC6ONtmFR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 40 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\00DA66B98AE3FE11896E6E9458E94CC6\2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe"C:\Windows\temp\00DA66B98AE3FE11896E6E9458E94CC6\2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-07-10_b0a674f3e540801c827953089e6c9f03_avoslocker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies system certificate store
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5a423a6a12fe4e5958e22d4382e3e8124
SHA1e9932b58b88a55c0f958729d909c7425a8d37541
SHA256e81dc2c3ff23d7ce547c7109a78ed876158f6f92cb684fb6256824f0800c0db9
SHA512f0e8f6620ae0e8b82d20e1c46c8fc98baf1bc47a3bb5075bfeaa59eeda1ab3a1deefe0c6b6c24201e4cd64dac070b5ad28bf951a7a69e4b3ceb60720d0676994
-
Filesize
342B
MD5a70fbc056ef768c6936a9dbdbf435dbb
SHA1a05a4dd0a4f045c0eefbf93a9937b2dc53ef91f3
SHA25610b79b9ce25b34a338cc913144fc780d286d79179a1b34497b4abbf6f483c4bb
SHA51229677f7f692c3adebe2bf72d1b78b719071249bf8d8cd47ebe741b0ed45afc423520bfc2f35c4c2314088c8f9ebd97c008e14b821f17655d4a72c9f6f2a4b7eb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
89KB
MD52c8f5ec07cb84d844e3fdee32b2a8e00
SHA12e27daffed27a7e6ee3adc50eef1710da318ca32
SHA2568d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9
SHA512ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca
-
Filesize
278KB
MD51bebc399a1b31eabc3361169df0316d1
SHA156091143fafa680dc65dd5f2b5d6fafa94590041
SHA256894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b
SHA512d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac
-
Filesize
56KB
MD5baf69d3c6977161e0c2b631b3f9958d4
SHA1a1b2982c11811c4e5f6bce95f3072a855d11c369
SHA256e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc
SHA5122fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839
-
Filesize
420KB
MD56181240bc579d2dfb176a1ca260f5a90
SHA1eb13b6cd4a242c8399396795d1863954b8d79507
SHA256b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768
SHA512f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f
-
Filesize
264KB
MD52ad2ab4f8517da8e2efdfed22ad49f1e
SHA155916e3e5c4c40cf2e5644fbad07baf31459673e
SHA2566efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7
SHA51212800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd
-
Filesize
283KB
MD5079ac68d4beb2ab9602d754b09ff652b
SHA190032834cc5cffd0b00119e4e38b5f4c5f877e4c
SHA2569377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e
SHA51253782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9
-
Filesize
631KB
MD5445e34aa976419cae54e13ede8d41ce5
SHA198ca3ee808f97ae16970b0fcefd3387bd07278eb
SHA256a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24
SHA51286b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4
-
Filesize
2.7MB
MD518defb1e3b7460f592a8ca61e4b40ff0
SHA18f8f7d7d1ee8a048d162603cc21a0f4c40b9036b
SHA25602a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d
SHA5127cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12
-
Filesize
5.6MB
MD53278c1155c263b1feed37a4485e07464
SHA125c405c0c4b39b3542874bdd927db147caa4a645
SHA256c3794a5439c3b67facfde818d9f08ef9913c08fca2fe658f84bc22133ce1711b
SHA512da08c6ea3e994ad452a6343a1f3029fff5dc122421b8a7006762a357e94691efb1c21f3e5a39635d64b82b49290227ba9524cf7b8b12f572ff3cc8e9aebc0145
-
Filesize
137KB
MD5a56a73b39703d5ff85b5cf12f9b00009
SHA1e6448c87f969e19ae4c6514d69d8286d26a2b5db
SHA256bb5966185017d904d2d7fd952bcc6d5c19fdf6bbbe34ab29c63a3784cd1074c7
SHA5127fa07a1fcc0735186ee71b3c123b1c4076f04dba5ad319588ea695ef117ab7c39918593e4ee42f18cbd3fe01d043e896981ca6f07293fc2fb0a9bce5d66992b5
-
Filesize
201KB
MD524e3b7177eeabdf085a01796b49c8e55
SHA16916a0bb98892252f59692fd0405e6da62af0f8b
SHA256eab963926cf2d62b575c6f33804372fea04db328b2b3f0adfb45fee3f27e5386
SHA5125e377e609673f3d84e22d070012578b8a18fce848a3815d9da05e10043d3e9fde8070094d1841acb44a4f876d8741e371a5fbcc86cce80cdf826131370a41e64
-
Filesize
109KB
MD5726d04bbe783a3510b18a491adac05c0
SHA111a01c68204dd80b32c01dcdb2e51f5b0ee34d98
SHA256639e091c9e87986eaf9fe00f0f401834e14878ebc48084697fd4307713a065ca
SHA51290592ddef83b6640cf8f28f0818098f95acc4139c7b3f5e8afa63bb873530be1613d42ee02dae12160737ee612187fc0139e19ee4a7f1abb3fec1fcaee1ae297
-
Filesize
55KB
MD5e4f6efef27708458ecda4ee22edf3cef
SHA107ccb5fa980dead816737ad83802cbfed18e4a4f
SHA256413e485d8dd07231d70107d86ee1a17ce705517aed8346b4701747d1fdbfdfc3
SHA5124920e508304df14041df1189938a1102e4a71e2e57ac4b9b804b6b0405c89c8292012a5ff4dae21268204ed6d9b56a279f4ce18d709074d1cba71cc9d5e11a1d
-
Filesize
998KB
MD5225a73e5a0cf87453832b578db6daddb
SHA1a36717a1b2c7eb2ba160fec5fa80e48b9e57c4ac
SHA2560499708762c56b9339c980e731ffab294e9b18362af3dcb4ad4481f1c7bd60c1
SHA512565ee2105bd626650857e0e6f9c8f7d87a68c3ec41923de119a3b710038a4785e16ccf79feb4c1c4f8a308f682163089228ac4ac81295cea754ae1189311c965
-
Filesize
203KB
MD5faec58e7785c287a7c688f274207048d
SHA166c038c720035b7212a7d3733da4520e3b95d63b
SHA2564c76dd0441a8021a308be24cf0c1957bee280451abcc1467acf47f1a6f7f5dce
SHA5129269a91a5bab01f076d8e9fde2991463fb224dc6382f8cde3a118e83cb35bdf580b4ea7686f2ea767a2a9c04650222edfc3a8b2569978b734c51b7135915448e
-
Filesize
69KB
MD50e203d24d04e89779638dd70d5335b39
SHA198ffc3718c6e34bd6d696bbcce605db666f99b01
SHA256f15b5199850b8ed98d2202972ada759823a17893a68d60ca3a0f76ee31aeb204
SHA512a07f54cce2add948340807b8ecf430e72c07032332046e5dd05d9da90f7d732921c0ff628592ff0710914ec9d9b7188b46377e1594a9f9809a107a022de1cfee
-
Filesize
4.3MB
MD5b0a674f3e540801c827953089e6c9f03
SHA1d0fbeb2bf51324360835e51b80ae0df4f80c760c
SHA256c14db4f709fa70fb70c7f3969cee4177d2641c098e06b1909af77e09addfa64f
SHA512fc2132048a7f8b25ca31e1f3f9a570124834a80633ad5b867513a73e87187c0ce2c2bf6cca1337ba468f3bc45c4c14bbf5d9ba39584ba3aa9d3b1e615a453afc
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
288KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
88KB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
264KB
-
Filesize
208KB
-
Filesize
280KB
-
Filesize
6.9MB
-
Filesize
200KB
-
Filesize
1000KB
-
Filesize
2.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB