1ccfce373df2edcfe4f41212893f35940297ff4be273683d30601fda85b1201b

Analysis

max time kernel
100s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe
Size

21.3MB
MD5

395f46395a9838dc4f6bb188945b623f
SHA1

1d603afc05a8c3ea09f15fd83017d93d14ba3304
SHA256

1ccfce373df2edcfe4f41212893f35940297ff4be273683d30601fda85b1201b
SHA512

cbd516e91cd25be441e9410e1eaad652b30b4d1fc752f9c8e68e879fd25510959bd06b6a839ffb402af8f081569c2b866e3d7ce034aa2b7c5325647be3ed01d7
SSDEEP

196608:w1wAT/Y/rja3K6RHUsvp2fA0rqNbuaUQGXnXCSxgJyL:wO3PaWfzrqNbj/GXnTx/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}	2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BC5FA7F7-925C-4DD8-852F-16A2BF672F44}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_395f46395a9838dc4f6bb188945b623f_avoslocker_hijackloader_luca-stealer_metamorfo_revil.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads