Overview

overview

3

Static

static

3

2024-08-11...er.exe

windows7-x64

3

2024-08-11...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-08-2024 00:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-11_eee0aee6c233fe852e805a07af71c3b1_avoslocker.exe

  • Size

    7.4MB

  • MD5

    eee0aee6c233fe852e805a07af71c3b1

  • SHA1

    c2de473caf7ae7ecc928c781f56c59e3694be7f0

  • SHA256

    739a67af47230ecc40cbfd938ba5844589a0c458c92737390119a927b2a38e62

  • SHA512

    1842f4cd444f3c56ee88fc87fcd0171600ab34d4af557f2882d6afab158666a39877177d6011af4a6c5e5b82a98ffa97562f181968558f052802d3957e77d1d6

  • SSDEEP

    98304:U4h5PfhefTAv8HM2JyiFpK6FR4FBm21BgdKqyyhab0AU:x5PfhoAUs2JyEYxBajH

Score
3/10
discovery

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-11_eee0aee6c233fe852e805a07af71c3b1_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-11_eee0aee6c233fe852e805a07af71c3b1_avoslocker.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 2416
      2⤵
      • Program crash
      PID:2384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 2464
      2⤵
      • Program crash
      PID:3508
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 732 -ip 732
    1⤵
      PID:1444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 732 -ip 732
      1⤵
        PID:3228

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\{10129421-3E71-4E0A-9605-44AECE7752BB}\CCDInstaller.js
        Filesize

        1.2MB

        MD5

        fbc34da120e8a3ad11b3ad1404b6c51a

        SHA1

        fe3e36de12e0bdd0a7731e572e862c50ee89207c

        SHA256

        9701b3ba335b5a11be32dd63ea3a466a14e048c1e5881cac81352b459be0f202

        SHA512

        f3f0452d16a7cd0600a8ffced5167783d3f31e51dce512872ade5031c97b14366af0343bfe2c822c8ac4a281f27f5eeb00fe7d0e8cbe90434f79bacf3ecb42d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\{10129421-3E71-4E0A-9605-44AECE7752BB}\index.html
        Filesize

        426B

        MD5

        a28ab17b18ff254173dfeef03245efd0

        SHA1

        c6ce20924565644601d4e0dd0fba9dde8dea5c77

        SHA256

        886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

        SHA512

        9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

        Download Submit