eac0deb5f07d1c1e1e966af325808cf28ac8fb58884ee139738a98bb70591cef

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_82388d8c3e5c0bfa17827040caff3a0e_avoslocker.exe
Size

1.5MB
MD5

82388d8c3e5c0bfa17827040caff3a0e
SHA1

536fdb3f9444c7bfbf92809db99cf9d98645c2ec
SHA256

eac0deb5f07d1c1e1e966af325808cf28ac8fb58884ee139738a98bb70591cef
SHA512

1d70c1ef30a76a7f4a8a5d42a36f580c71398665730202493ad27e6baecc750c99bc960e94ff2d8fe029f49b5b2ca3317034115653f944d63c9d8dcba66ddf70
SSDEEP

24576:4ltVILvhoA3DbsspU0mTgqj11DYf2orphL/+n9KT8rKOsqjnhMgeiCl7G0nehbGT:4LVW8spU0mTgqjPDYf2uhL/+9KTQKiDq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_82388d8c3e5c0bfa17827040caff3a0e_avoslocker.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-19_82388d8c3e5c0bfa17827040caff3a0e_avoslocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_82388d8c3e5c0bfa17827040caff3a0e_avoslocker.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-0-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/1792-1-0x0000000001E60000-0x0000000001EC7000-memory.dmp

Filesize
412KB

Download
memory/1792-9-0x0000000001E60000-0x0000000001EC7000-memory.dmp

Filesize
412KB

Download
memory/1792-13-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download