19cf1e8de87f268fc64e89fd04474997b7a24ac47d9c990fbb1249643bde4c65

General

Target

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Size

5.4MB
MD5

ecffc12790375a24fa4cb0e7b3799d7f
SHA1

5f78b672871793ca05bf61ff6ba50f99d733b0c5
SHA256

19cf1e8de87f268fc64e89fd04474997b7a24ac47d9c990fbb1249643bde4c65
SHA512

7216d8b44efca1a3af192c24e4cfa5daa6df33c902656e1c303bb83e9b522f9c720d87a819ee6eb12762a17adcda76970a004139a3b1121323eb060907892d5d
SSDEEP

98304:2rI1lEAOYB6RJ2dqW8LZJc+ZQSAA4zJOi6f4s/w0dGw/qn:9XGULEFrcPJzAxf4MFGkS

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

Modifies system certificate store 2 TTPs 28 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TrustedDevices	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\FlightRoot	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\TestSignRoot	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

pid	process
4368	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
4368	2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-01_ecffc12790375a24fa4cb0e7b3799d7f_avoslocker_hijackloader_magniber_revil.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4368