Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24/07/2024, 00:39
General
-
Target
2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe
-
Size
3.9MB
-
MD5
5b15aeea8ee9f6a6407be7e3e2088cff
-
SHA1
103d28874f841474b179364f1541c74025bcfb5f
-
SHA256
817b7cf67532cd72d7ed576a86768c0d21897401c8c47db580f8de0ebadb29dc
-
SHA512
457458571d4f0727e47da80b01347587add72006104f0a3b948a31b008e613425b846dbcaf83322cd29958279640a1d3407f5cf768bb3f417d7c56b5f1d0a49f
-
SSDEEP
98304:xsRRaGVKg/Z5k38aYfUvFgi4ZxDaMqPXpoO6:UVpTkvvd47DaMMXpol
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 42 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\0B192A225594FE11C92CE64D318855A8\2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe"C:\Windows\temp\0B192A225594FE11C92CE64D318855A8\2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-07-24_5b15aeea8ee9f6a6407be7e3e2088cff_avoslocker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD50e59b36b30984880aa8736d3efb4f157
SHA14de8339002503bfae3fad5a6f64cbbadac966ea8
SHA2562415860ac6b5be4b9102da8a7f3bfdb1fc738f058dafb6d4e108d138c9fa9b51
SHA5126eaa9322d980f218d326631f64548fd02d9aeb1e90a560135ee7d3cf0670a953acce0f026e69679d52f8bddc69e38d33fa56831053ae932ed58af5e4550844a7
-
Filesize
85KB
MD5783977698c49b0d14a9c1a58707a6ed1
SHA12c194e542d6cfb01c1870d10a588ebebab6d9bbd
SHA2566b1ef093643ff37d122eff63dfb94fc5faa7f600d19909077441837a9db34031
SHA512e99112b2e880956cec9bbe6be3ff0581a292a9aa8de52db9d944fa10e55f45700f8e3c3e7697c363a08a05a7a0b33d670587ec10a7c02c4069eebed92133954b
-
Filesize
526KB
MD5cab2d71bfb9447f0e93a26ac5a8914f0
SHA1479319792e8079c520c277b89c34ee51f3451a65
SHA2561c0b743015019769efaa61b4572fe46bfff74e39517ecbf903238d69d2fdb339
SHA512ecac858e3254fb0cd3755817e92c19d6073e9e795d9fe55f3d47025c224e48c5f27b4ca0c0e94c0d46ed03853248f396a76144ae3512d76c0ccb727fe9b621f5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
39KB
MD53ab57a33a6e3a1476695d5a6e856c06a
SHA1dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7
SHA2564aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876
SHA51258dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92
-
Filesize
98KB
MD58e854a3c89d2830cc6be3c52a47347c9
SHA1b382838fb89b1ea705c4d49e7d6bf15b0df32d3c
SHA2569878b9ba16b3a898f4d3ce6d857c8f53ccaa74eacb073b606c3cbf947bda84e4
SHA5125f92da96d27a7870095606232255c60ccc7768e73779f01600d33e15fff5ea764a43e8c7f78e99430ced44d254fc7254db566386144857e075bbb58613509802
-
Filesize
276KB
MD55b8032de52ad7af543e6bba902bc1682
SHA1dc2306150860bdb3539469c19bdbd7372a154ba7
SHA2562dd2ca43db0bc03f28ca628af87f077b499d7267afa055699303386719cd06c5
SHA512d57cbdb0a2beb332f19f663753afe7436168d30c8ed43fa6be7434f94ceb613f3aff42f98dced843dd527ce6306ce2bb5d34cc16902f48ca6debca2d0b2766d0
-
Filesize
56KB
MD574e63994c9f35b775226b548db5cfa10
SHA133a11b8db899c88069c9ff6c6512b859b2e23d4a
SHA256a464ee988471335f2e8dbee81bb2c6f7f11bab255a98fd29eb0b1863fd0d77e0
SHA512296d81d2cf5f804076eda94c0db7c3f1e43a20238481a38a943302e7778f4b3b130d1811a1984c313e8123a350bfc37cc0dd264237b86fc10c142e019014a096
-
Filesize
216KB
MD589bddd5f9aa7aff6fdfa44a7f8eb8691
SHA1cca9d46438f332ad70200414409fee875c0a638c
SHA256bc294609a8d95d889c744186abf5af9fd83c382d3efd595449632465f03812b7
SHA51202ece167a30db2e8fb4a39ef06f060de02711778f4e84e7e2f06c6d3c7cc3f911e919a0c11e0d1c4c56e268589072caf860f9f8b0694b51e80282e802d25c23f
-
Filesize
278KB
MD55c3e60608f0998dc065d939f718da715
SHA18293ce337beebb3a5440ab3c0b27aac85d355439
SHA256ccef75eebd6d5b2104779995c05d07c348aabfda228bcd117f3a945571f550d8
SHA512d548be3cebd72edc909a8b1f2811bdb2b27e5cdea194e61a621689b4afa2544f68b9e4215fd8db767ce37224325d3611e5a27c42ce0467025208db42508c1edb
-
Filesize
2.0MB
MD5b77fef38e2ba24c132060203af15bfe2
SHA1bd34b6369a04777270207e4b6e81bc7a748cc70a
SHA2566a1458c6065a5af4ddc4bdaa9cd41cfbdac9411d04526225d46dfcacd4019b9a
SHA51251f1403e06c226ad866f147990fc9e30180838d532ebf7d99e8a3b2e0a06e787fd96dcd17ac1106a32b26f55d78fe798b83507607584b5aa6990402dfddcd9a7
-
Filesize
5.6MB
MD5cb03ad9d3bdb4aaaa718dabe511e05f3
SHA14a2ea9e566991f9d3176ab7b847225e2b8006186
SHA256f1e8b6cd978e92e5848d9b5fed809eba0df84ad91b6dc83ec11b1faa0d57686d
SHA512c1100fc21f1512c4357ab8ff2793860fa7b952f3a5b859b9a920c96926821684b1b7138e9ce139b5a21760acb61123b35059a83d10f59a4fd444f03e3092c924
-
Filesize
137KB
MD507a04fc1329958ccbb1e7ea69d00746e
SHA1c167dd5d143217942590b8164afc386d4641994e
SHA25687bb7b7b624bba6b8ee8195f978195de74bdd379af4f751a0aeca833eff0ed5b
SHA5127695df3d00c02db8f45c144ea1a0ecff065f9d1412be28c2616d6da60c1793361d0622337d0bc645c9cb56ec89cddb561df53811df637f1d5538d9a0bdabe9a0
-
Filesize
201KB
MD5df4d6e152f722f958255d55de3730e3a
SHA12c3d920d611d33e0032e2b1cc4d9fb4236e513b1
SHA2563d0d860b0eef92a12195365bbf4b6ad9616670025f620ab85d91b3e8d9042a61
SHA51292d1d5657f3c4c62615271aad664647bc59b935f07d904358276f7ac9db7474a825f0c7a7fee536a3ccd21eb218768ccfb9f57c9763727ea22172e86aba9a6f7
-
Filesize
109KB
MD5734199fe9d700367456e9262b0b97304
SHA1fbe4f7ae290a48a383b63874554075bbfdd4d0cd
SHA25616863cc4b30454c3db883640468e466dff6e49bf8140a0e07730bb5d4b460362
SHA5120b499fbc4ddce4d802baf8442233ccca2da591274f5cd6db69e9da0898b44e61f43aa75b85b91caf6743124a125b6f740288b346178b8c7aa7917675bce51d37
-
Filesize
55KB
MD508cdff748538150c3da8a93a1564a126
SHA1d395b71a71997b2fb29bcd6b1025ba0ad92d7a93
SHA256c3f0e79bfe0d9bf666f2a228bbce3bbffa76e95056c8ca00bc527d69907a9d23
SHA5126c02eb6015f1439a94bf6679a6b096498d8c8beb83005f06c2fd83b93436266100194f5a37b5d454d079fa6013bc76bd24db7428beb624fd8b7783dd6881beb4
-
Filesize
997KB
MD5910b0bd94e4cf3e035b0cd2ae475428d
SHA1f450028f3c1df114c1daedf389af1f2b97dac24f
SHA256ddd65384bc82877842bc400433462fec9eb9bddcb14e4c9f4116ad8a6b90e140
SHA5129bf81cdf5c3634e9b636049adf27b84c24a142a7298818fc3266e5d9fc70479d687e9be89b58bdeab8fd0d0ccb8d7a383e198f5127c9f72a4283d6652adb0822
-
Filesize
203KB
MD5e72cd958b1496e185bfe94f7b1cb5ffc
SHA14d662a6c150b5709d153a4caf1f1333d0f6579f4
SHA256d840f7d0e681ef80d7446d4acd69eda37c40735c3b514c63cd68fd0b3c523c97
SHA512afb864c27f6296c75a802549074dc9b3a75a87be742c307bb8d0748ad57e14f318451d8f771c313999b624d9039cff85e72f704a77914552b151c184f85d0764
-
Filesize
69KB
MD5b298b2f21f4938ee10e4c6b971daa9db
SHA12db6ba107e049a88093e20b5a56dcc248e747273
SHA25604458af262f04dc2df8d8907eeab5c43f1ab815e62f2785651e0e69482af9548
SHA5128a020baacd1277ef7aadf47f6d50930d949395ee4b7fb3ec0ef3c0b9b71e9ae595409b313569ec267f1ada0e920f2f7468b0b0e832b61d759e1373dceeeac7ec
-
Filesize
3.9MB
MD55b15aeea8ee9f6a6407be7e3e2088cff
SHA1103d28874f841474b179364f1541c74025bcfb5f
SHA256817b7cf67532cd72d7ed576a86768c0d21897401c8c47db580f8de0ebadb29dc
SHA512457458571d4f0727e47da80b01347587add72006104f0a3b948a31b008e613425b846dbcaf83322cd29958279640a1d3407f5cf768bb3f417d7c56b5f1d0a49f
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
528KB
-
Filesize
1000KB
-
Filesize
88KB
-
Filesize
528KB
-
Filesize
280KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
208KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
280KB
-
Filesize
200KB
-
Filesize
6.9MB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
6.9MB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
6.9MB