Overview

overview

3

Static

static

3

2024-09-08...er.exe

windows7-x64

3

2024-09-08...er.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    90s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 00:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-08_97c7fbdb1534e6bb4bea0e2ecf2ee660_avoslocker.exe

  • Size

    7.4MB

  • MD5

    97c7fbdb1534e6bb4bea0e2ecf2ee660

  • SHA1

    da2730f6fa26163202354c5b46df7fc5c158615e

  • SHA256

    7dff0c36876229186958ca3297fe50c71a36e00801e2af57e86eba2bae26cc0f

  • SHA512

    a4ab9f9ed44c87b0a8d828c84d0d65560b4d208b4fcc7b3e12b75f37a2ceafb2d0bbb6cc80367590e33b14128a428939c0663ad84bc7dd3dd98132938aa39f7b

  • SSDEEP

    98304:L/o+sqRtdd8LtT0On9mp0+IAsZYNnuWx94FGoXab0Aq:U+sqRtML9rn9mStmnadXjl

Score
3/10
discovery

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-08_97c7fbdb1534e6bb4bea0e2ecf2ee660_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-08_97c7fbdb1534e6bb4bea0e2ecf2ee660_avoslocker.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1856
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 2460
      2⤵
      • Program crash
      PID:2320
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1856 -ip 1856
    1⤵
      PID:1924

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\{145F663F-AE82-4039-94BB-B9DFEBC2F656}\CCDInstaller.js
            Filesize

            1.2MB

            MD5

            76d91be7bdb92e541b3face5b94e9f0a

            SHA1

            22fb1d2239becd45cf81166fa522de1e8b495a68

            SHA256

            302b9bab186ed0e233f55cb660e0d0e326479e84855f0bb68e7632313238bf11

            SHA512

            eeacdf9c19029ffc8b9cf876419b86503e019fe3a25ec90a7ba27988a215a67e7f73079f74921d184ff4d93cdf4adca5f95eb10250f96716df5a6c879f389eb0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\{145F663F-AE82-4039-94BB-B9DFEBC2F656}\index.html
            Filesize

            426B

            MD5

            a28ab17b18ff254173dfeef03245efd0

            SHA1

            c6ce20924565644601d4e0dd0fba9dde8dea5c77

            SHA256

            886c0ab69e6e9d9d5b5909451640ea587accfcdf11b8369cad8542d1626ac375

            SHA512

            9371a699921b028bd93c35f9f2896d9997b906c8aba90dd4279abba0ae1909a8808a43bf829584e552ccfe534b2c991a5a7e3e3de7618343f50b1c47cff269d6

            Download Submit