Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
23/07/2024, 19:04
General
-
Target
2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe
-
Size
4.3MB
-
MD5
d3494ed3562c025af379a4e5e4604eaf
-
SHA1
ddd1fc569f870e71e439d12df33c47fcf34f3d0d
-
SHA256
d71b5318602e3049751838ae77ebec100cb172eb9eb66f3770ec3b078fc639ad
-
SHA512
800cc17def98fb875629bfe3cd163bfeed45a1e18271170d5847611e4f38e261c28ccfe333e8ae3c4579121f0f4c63a50880e38c5f6e1560112b53709b32d23e
-
SSDEEP
98304:Rpq/d8kCB8lMyQjujDW9tBcg2jGqwwAF6vAVpRBQo3g+Y/skB3tiXU:KcT5ujyp8jGqwwm6vAtBQo370bNtmU
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 64 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\ADE604D56294FE11B881A5318E31355A\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe"C:\Windows\temp\ADE604D56294FE11B881A5318E31355A\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.387.0\au_setup_5D538302-4926-11EF-8B18-5A13E81353A5\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.387.0\au_setup_5D538302-4926-11EF-8B18-5A13E81353A5\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" /-self_remove -l=tr-TR -xpos=270 -ypos=58 -prevsetupver=21.17.7.539.0.135.03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\1CE899466294FE11B881A5318E31355A\startup.exe"C:\Windows\temp\1CE899466294FE11B881A5318E31355A\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" /-self_remove -l=tr-TR -xpos=270 -ypos=58 -prevsetupver=21.17.7.539.0.135.04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\temp\ADE604D56294FE11B881A5318E31355A\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe"C:\Windows\temp\ADE604D56294FE11B881A5318E31355A\2024-07-23_d3494ed3562c025af379a4e5e4604eaf_avoslocker.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\FF2835D56294FE11B881A5318E31355A;2940"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD579a78149e4ef2e6e09cc061338c7b151
SHA199505d2461a18f16d4d185603887c60e226347ee
SHA256e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
SHA512a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e
-
Filesize
142B
MD56c55eb4595987ac512938f47e2bf3662
SHA187f5602cf07dd5f08367a6a65c81eac0090f0945
SHA256e320c3556a5b11eae51946e21f0ae5d3aeec78195dc884a88a7536d7db6df87d
SHA5125474a1ab1394dc718945992f9f50910719c66b5af892cbc8db84edfe521eb24f2742871f6c43e00d67565b5a6d435f9e7f60c1febbf4ea577674965aa84f4f21
-
Filesize
4.4MB
MD56ea1a5adeb9991d62c70fa1871f8256c
SHA1e619ba53da7eb9530693d5a6e7fd05a4978ea9c5
SHA256d1ae20fa8a8f62d5af421a78e4f3e8e064c20a2646b740954f2ea5e6704903ba
SHA512c41db4aa261dc9a2e9a55a5ec42fa425d6fcb11570b47e080141d532be56e61d4dff9f1f71124d27861999b005ad60a89b8ddc397a4bd046274bfa848cbf04b9
-
Filesize
582B
MD5ae7d1aa0eed1cedb7bbed567fe59f8ef
SHA1833ec047c33510a89c6610b4be752afde3a8c1fc
SHA25671bb8a59ee3f6e1009f72966bc9fbbec145ff54b61d954885f151c6d3586e0db
SHA512489eb87bd6782e756503038ce28fed84f54055e2c3702b9f8b34fbc092b90e064d5189e68fd2045f0f5ea180fefee265e19eec055078da5cdd232b80e3500af0
-
Filesize
5KB
MD543c4915fe6b70c29b72edd4a7dac846c
SHA138ed48f37a9d54db01fb6a66b093bd7d03227602
SHA256448b173f47074eaa1715b84b025ba0cfa7a73c01860b8888cb7849d85bf6ffc0
SHA512eddbafd5a70e6ae8ec7389cd422dcf8d6057b45f614f519379cdb0c7f0bfc55521e0955660d9802f6b4cb83c0f4b23a74bd7421969b24d6590bff0b034b41cec
-
Filesize
318B
MD57830b747b9166764b13437c6b756f4ae
SHA1733e86be84a67d2b61d255aa3230c4759d79623a
SHA2568f290a5171b1fb70b94be3a074c3bb3d0ce27e0e205901d1a102b24bee176c53
SHA512b13f1f7a8a29f39441e1be6bb28c85d28cfbdc08ecade6ef3eafacf6eb4675caf5bff81bbb0a0a23919e02cc416e351b427f0e96fa4285be84ae6b0412020bdd
-
Filesize
22KB
MD509c4e9f41c4b8bfdb6bf8916af730ecd
SHA1a215913aa718b459d8e3c13dfd22e5246dcff38c
SHA25657bf969d3c10d5be0a4b31b8e530c1e005622c8dc809ee4fbd4c214f3b3e9a37
SHA5127767639c5e068fd3e83a527dfce0345c902673e50102a6c5ba3998ffa2d16f0417a74bee15fce9b6825eabe94f6d36c4528cc70c4541294415b26b9f0f64937e
-
Filesize
3B
MD5ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA157218c316b6921e2cd61027a2387edc31a2d9471
SHA256f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
SHA51237c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
-
Filesize
40KB
MD55e8149abcb97155deb6a665f6c9eae6c
SHA1fdadb330f162769811ac3f0512db8075b89419d7
SHA25695b2a6e43a6f5d2e0da5a3508f0e84f17c81ad078a33ffd64c3cbd03eb6dc29d
SHA51237df1832f767822b2b7dd492a91fe30597587fe7e38cd4338573e03088e96080c039fd14e77cb34b9088ae452de137dbb10a8eb229e639f5be075a310cfbf2aa
-
Filesize
605B
MD5fa80837eac16a6175ff54aba85fe9b1d
SHA121db19c8ef9753b74659cea9d318713fca283a82
SHA256b1855061355b98c82020b77ad36bc8b752a456793cbf9c7e9ce0a51e956b11b4
SHA51259d7daf8aa2f0ac59e2ce0209a035a9cc5061c52dd8cde3ab71be0db21e8172a9c178f1046d367c534bc06474892d9c5827bb596afb4e3d6f2aa43593f766b19
-
Filesize
18KB
MD566388e1c536028a65914bfdcf6b27ba8
SHA16cd300498c354dbd55432e8983c4ec31a00d499e
SHA25610dc4d10376b8b19bc8f15cdc221c06c59680b5cb3855b23440dc2be64c4a5b2
SHA51219a84e9628b662636c4fd80c8139669dab78a071bcb9ec30a3954a9892b3e65c2497b34e2666fe26ea589bc7e7b2b4a0b3735994a872b3c86bb71297494c176e
-
Filesize
1KB
MD52e10b2d4181d2f07d2dd305bd4285bd5
SHA19c05f3e03bae36da24a62b08729074cd12b0077e
SHA256cbb72cdc1e461226c7d0e49e7ef955f77dfeef4f7fe12d0d8a8d0cf9658edc78
SHA512a1bae84b8a9c0833bbadf29d4532b64f0216d7c1c13be2b4ebb75dd4d2b18244eb67fee52743745ed0a5818e745cb9aae9a8bfdc415ff59ee8aa7de77f122819
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
56B
MD55fc1e104c2c6eca5eaeade1f931736ee
SHA13252bdad7d8dcd9dd22b5d5cacdf1537b6a84b11
SHA25656df17509b96ba8fade248fa3f64f30d8939b060d7b78f92135c3407c92a1359
SHA5127787a2305db0feff04ae2e2bf8ec7d44a1ac595bafc5be8c5f07abb567e750805708ec6c78db5ed9f1d247e9db9f915bcccacfe37ebd766a514addaf0b6e5576
-
Filesize
10KB
MD5466f4bbe54d76b634f1c801988323859
SHA1e02ddfb73c81e4e4fdb0eec5b8b8606d3b566a27
SHA2563b04135e2025179683213499aa09a73207c21dc4cd38152062ebb94873c47554
SHA512645e5b1a517965073961ef9fab6c92628a689c80b45ca9025f1ab7301cfdbbcd8fe6e60c40aa68944253eed565b5f7fe1d3e1fb609fc818ab0da3b67babb5e2c
-
Filesize
4KB
MD593717b0d24f863fab93a8cc88d2d2e8e
SHA16e1889af69927e52b793533b87a35d5dda118587
SHA25634bc65010efcc70cd8a1b890fc742ec26d7262f188b7d7f304cb30108b9712f5
SHA5120adb48e77ad402e40209ae7b1d719dd37efb0e434ab59e05ac6a7c3fc08e20a24e074b5990e2e85d979242f4ffed962fa545b6b86b9742a56cb859bd8df12209
-
Filesize
5.6MB
MD59cdc164ddde6c2e1105a53c114d697b3
SHA1ad10faf4e4906b01b192610cb2153f725a052e5a
SHA256bd69b5c7e92abb0bad38f4d65290fe9e7cb2429e5b82620741198608053cb72f
SHA512c7df7b8d8adbfa7d9403386e073083d672067345777072dc22481fa7b37662cb2a879e736d7dcf1223d6128210df0f6b1c3c32d96912cc81d68bf26eaf9ddc8f
-
Filesize
89KB
MD52c8f5ec07cb84d844e3fdee32b2a8e00
SHA12e27daffed27a7e6ee3adc50eef1710da318ca32
SHA2568d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9
SHA512ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca
-
Filesize
278KB
MD51bebc399a1b31eabc3361169df0316d1
SHA156091143fafa680dc65dd5f2b5d6fafa94590041
SHA256894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b
SHA512d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac
-
Filesize
56KB
MD5baf69d3c6977161e0c2b631b3f9958d4
SHA1a1b2982c11811c4e5f6bce95f3072a855d11c369
SHA256e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc
SHA5122fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839
-
Filesize
420KB
MD56181240bc579d2dfb176a1ca260f5a90
SHA1eb13b6cd4a242c8399396795d1863954b8d79507
SHA256b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768
SHA512f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f
-
Filesize
264KB
MD52ad2ab4f8517da8e2efdfed22ad49f1e
SHA155916e3e5c4c40cf2e5644fbad07baf31459673e
SHA2566efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7
SHA51212800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd
-
Filesize
283KB
MD5079ac68d4beb2ab9602d754b09ff652b
SHA190032834cc5cffd0b00119e4e38b5f4c5f877e4c
SHA2569377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e
SHA51253782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9
-
Filesize
631KB
MD5445e34aa976419cae54e13ede8d41ce5
SHA198ca3ee808f97ae16970b0fcefd3387bd07278eb
SHA256a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24
SHA51286b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4
-
Filesize
2.7MB
MD518defb1e3b7460f592a8ca61e4b40ff0
SHA18f8f7d7d1ee8a048d162603cc21a0f4c40b9036b
SHA25602a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d
SHA5127cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12
-
Filesize
5.6MB
MD5816f9b62aeeca708661dcd72da3ecb74
SHA1c26a9bca4382009e61177598bb50f69fb88e88c3
SHA2563d7dd3e6ae9e4ef059f56f4eabcd8bdb519a2a1fe4cc5219c7a1efc1d554c4e7
SHA51253a2a3ceda1560f51fd006efedbc2adc8c8110cf8942c72e4d93ced56d693be70002c3fb1ba3503c88c22cf344dc4a64191b3bf729bcbef9cce8b8cbcbc900cc
-
Filesize
137KB
MD5a56a73b39703d5ff85b5cf12f9b00009
SHA1e6448c87f969e19ae4c6514d69d8286d26a2b5db
SHA256bb5966185017d904d2d7fd952bcc6d5c19fdf6bbbe34ab29c63a3784cd1074c7
SHA5127fa07a1fcc0735186ee71b3c123b1c4076f04dba5ad319588ea695ef117ab7c39918593e4ee42f18cbd3fe01d043e896981ca6f07293fc2fb0a9bce5d66992b5
-
Filesize
201KB
MD524e3b7177eeabdf085a01796b49c8e55
SHA16916a0bb98892252f59692fd0405e6da62af0f8b
SHA256eab963926cf2d62b575c6f33804372fea04db328b2b3f0adfb45fee3f27e5386
SHA5125e377e609673f3d84e22d070012578b8a18fce848a3815d9da05e10043d3e9fde8070094d1841acb44a4f876d8741e371a5fbcc86cce80cdf826131370a41e64
-
Filesize
109KB
MD5726d04bbe783a3510b18a491adac05c0
SHA111a01c68204dd80b32c01dcdb2e51f5b0ee34d98
SHA256639e091c9e87986eaf9fe00f0f401834e14878ebc48084697fd4307713a065ca
SHA51290592ddef83b6640cf8f28f0818098f95acc4139c7b3f5e8afa63bb873530be1613d42ee02dae12160737ee612187fc0139e19ee4a7f1abb3fec1fcaee1ae297
-
Filesize
55KB
MD5e4f6efef27708458ecda4ee22edf3cef
SHA107ccb5fa980dead816737ad83802cbfed18e4a4f
SHA256413e485d8dd07231d70107d86ee1a17ce705517aed8346b4701747d1fdbfdfc3
SHA5124920e508304df14041df1189938a1102e4a71e2e57ac4b9b804b6b0405c89c8292012a5ff4dae21268204ed6d9b56a279f4ce18d709074d1cba71cc9d5e11a1d
-
Filesize
998KB
MD5225a73e5a0cf87453832b578db6daddb
SHA1a36717a1b2c7eb2ba160fec5fa80e48b9e57c4ac
SHA2560499708762c56b9339c980e731ffab294e9b18362af3dcb4ad4481f1c7bd60c1
SHA512565ee2105bd626650857e0e6f9c8f7d87a68c3ec41923de119a3b710038a4785e16ccf79feb4c1c4f8a308f682163089228ac4ac81295cea754ae1189311c965
-
Filesize
203KB
MD5faec58e7785c287a7c688f274207048d
SHA166c038c720035b7212a7d3733da4520e3b95d63b
SHA2564c76dd0441a8021a308be24cf0c1957bee280451abcc1467acf47f1a6f7f5dce
SHA5129269a91a5bab01f076d8e9fde2991463fb224dc6382f8cde3a118e83cb35bdf580b4ea7686f2ea767a2a9c04650222edfc3a8b2569978b734c51b7135915448e
-
Filesize
69KB
MD50e203d24d04e89779638dd70d5335b39
SHA198ffc3718c6e34bd6d696bbcce605db666f99b01
SHA256f15b5199850b8ed98d2202972ada759823a17893a68d60ca3a0f76ee31aeb204
SHA512a07f54cce2add948340807b8ecf430e72c07032332046e5dd05d9da90f7d732921c0ff628592ff0710914ec9d9b7188b46377e1594a9f9809a107a022de1cfee
-
Filesize
30KB
MD58e4080fdeb0c1c02c7697efe69edca7c
SHA1a7503be947fff11671f1b8b7126bde5af7d00828
SHA256ba80be9d85b93b21afef1eb30c67ff9acb01bd2c1dfa7cbf80287db991b26668
SHA5123a9dcb338a65593f1613740a9f23c0e0527b8b80af5ad7c8995f79b1b0c17c495fe01d555d8c1307fed28febbbb97b737a254bf3e7d10b63681a4020bc8b5118
-
Filesize
4.3MB
MD5d3494ed3562c025af379a4e5e4604eaf
SHA1ddd1fc569f870e71e439d12df33c47fcf34f3d0d
SHA256d71b5318602e3049751838ae77ebec100cb172eb9eb66f3770ec3b078fc639ad
SHA512800cc17def98fb875629bfe3cd163bfeed45a1e18271170d5847611e4f38e261c28ccfe333e8ae3c4579121f0f4c63a50880e38c5f6e1560112b53709b32d23e
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
1000KB
-
Filesize
112KB
-
Filesize
136KB
-
Filesize
56KB
-
Filesize
208KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
632KB
-
Filesize
7.7MB
-
Filesize
2.8MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
288KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
264KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
