Overview

overview

10

Static

static

3

2024-10-02...er.exe

windows7-x64

8

2024-10-02...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 18:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe

  • Size

    8.6MB

  • MD5

    45beee362263f775f572b18a4aeec0de

  • SHA1

    fd32e703b282412371d06e800f35a4446482654d

  • SHA256

    410025278f63c2177d732ae410a4713a84d59167f3e92b48d779d071773e0ac9

  • SHA512

    f1d660cbf50cda72a377eb72e6347d4a47efd9c3c6a3552d855e808ecfe861e22f8c6e92f33c1504842d51335ab5aadff6d869e3555bfa202fb9c3983030114b

  • SSDEEP

    196608:sTB9dOqQTB9dOqoTB9dOq7TB9dOqXTB9dOq3FIF0wu:szdOqQzdOqozdOq7zdOqXzdOqv

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WIbQCONN.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WIbQCONN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F53.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1632
    • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
      2⤵
        PID:560
      • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
        2⤵
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
          "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
          2⤵
            PID:2532
          • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
            2⤵
              PID:2920
            • C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe
              "C:\Users\Admin\AppData\Local\Temp\2024-10-02_45beee362263f775f572b18a4aeec0de_avoslocker_hijackloader.exe"
              2⤵
                PID:1020

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp1F53.tmp
              Filesize

              1KB

              MD5

              9dc621791ea5965bac4c439caa13199e

              SHA1

              eef87dd560ccc0872ebce696754c4718fcf42ffc

              SHA256

              e74284f9b80a5ab710a1aa3e470694ff0a74b7b9312b3dd904831aad8f518443

              SHA512

              155b3779961d056032df8846417b38c34fcc2784096068f66f1df1f145171013031c69f3ecf35fb7d211ccaa85ec5dcc0e8f02bb706ecade3586a19bcef2e720

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N5FEVGWNOX3WPVJWPIFH.temp
              Filesize

              7KB

              MD5

              913645a4d60cbd8e84e556c709ab2f27

              SHA1

              de9d0a7aca954c5615fa01399cd4c9f7d6539cc6

              SHA256

              c52f09e133c1209cbbc4c56bfa833b9f6dcc7002c15574a30198f62e847b247b

              SHA512

              7bf04821359faf4dcfd90bddc46cc3de1ca6542bc6030a4b0889f185fe9e00cb3e206a38e74540b5d83f5adb71a682826541c354bcb7cf7b82e4414c3208198a

              Download Submit

            • memory/2648-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2648-1-0x0000000000260000-0x0000000000B00000-memory.dmp

              Filesize

              8.6MB

              Download

            • memory/2648-2-0x00000000748E0000-0x0000000074FCE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2648-3-0x0000000000CF0000-0x0000000000CFE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2648-4-0x00000000748EE000-0x00000000748EF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2648-5-0x00000000748E0000-0x0000000074FCE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2648-6-0x0000000006660000-0x0000000006786000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/2648-19-0x00000000748E0000-0x0000000074FCE000-memory.dmp

              Filesize

              6.9MB

              Download