Overview

overview

7

Static

static

1

2024-06-30...er.exe

windows7-x64

7

2024-06-30...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-06-2024 11:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe

  • Size

    4.2MB

  • MD5

    283a085ca603e762a0cdfeca133078d4

  • SHA1

    5803a411f902ab17cb6ac5dfd4961fca8eb235a4

  • SHA256

    4682f33401c6f649275c861d4f293c4a99770b72c1089529e9f893b50985e515

  • SHA512

    5a988dd55c038983e5918bdce9f083eb8e10cbb47bb7ba1d3c9e916b107d486837127c6650379449b6be996270b7cf447d782a297719d32446ae732a3b00a494

  • SSDEEP

    98304:gpq/d8kCBnlMyQjujDW9tBcg2jGqwwAXSY+139YOtYsnYT50kB3tiX9P:Bcu5ujyp8jGqwwCq3t/2Ntm9P

Score
7/10
evasiontrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 40 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\temp\0ABCF9966D63FE115919A6383DC215E5\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe
      "C:\Windows\temp\0ABCF9966D63FE115919A6383DC215E5\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Modifies system certificate store
      PID:2996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Tar20B1.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.setup.ui.core.dll
    Filesize

    89KB

    MD5

    2c8f5ec07cb84d844e3fdee32b2a8e00

    SHA1

    2e27daffed27a7e6ee3adc50eef1710da318ca32

    SHA256

    8d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9

    SHA512

    ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.setup.ui.dll
    Filesize

    278KB

    MD5

    1bebc399a1b31eabc3361169df0316d1

    SHA1

    56091143fafa680dc65dd5f2b5d6fafa94590041

    SHA256

    894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b

    SHA512

    d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.setup.ui.interoplayer.dll
    Filesize

    56KB

    MD5

    baf69d3c6977161e0c2b631b3f9958d4

    SHA1

    a1b2982c11811c4e5f6bce95f3072a855d11c369

    SHA256

    e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

    SHA512

    2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.setup.ui.visuals.dll
    Filesize

    420KB

    MD5

    6181240bc579d2dfb176a1ca260f5a90

    SHA1

    eb13b6cd4a242c8399396795d1863954b8d79507

    SHA256

    b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

    SHA512

    f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.ui.framework.dll
    Filesize

    264KB

    MD5

    2ad2ab4f8517da8e2efdfed22ad49f1e

    SHA1

    55916e3e5c4c40cf2e5644fbad07baf31459673e

    SHA256

    6efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7

    SHA512

    12800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.ui.framework.localization.dll
    Filesize

    283KB

    MD5

    079ac68d4beb2ab9602d754b09ff652b

    SHA1

    90032834cc5cffd0b00119e4e38b5f4c5f877e4c

    SHA256

    9377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e

    SHA512

    53782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.ui.framework.uikit.b2c.dll
    Filesize

    631KB

    MD5

    445e34aa976419cae54e13ede8d41ce5

    SHA1

    98ca3ee808f97ae16970b0fcefd3387bd07278eb

    SHA256

    a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

    SHA512

    86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\kl.ui.framework.uikit.dll
    Filesize

    2.7MB

    MD5

    18defb1e3b7460f592a8ca61e4b40ff0

    SHA1

    8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

    SHA256

    02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

    SHA512

    7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\setup.dll
    Filesize

    5.5MB

    MD5

    0bf11445ce2c07a3ab2a52a4adb87e8f

    SHA1

    77016ae035079d52db244311dfdcf1157eea2c69

    SHA256

    5adfffdd80d872741e7c8f3211f6f36da9d1ed0c78089348d747dbe6281ec1d3

    SHA512

    7e9dddb2df5ffede79a835e30dd82319a1b366966dfd4ff45e4b6c46157ca2d381e68a766a3db743158066f95b6ad2ce61b375e86ae84855d39239858cfd1046

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectorconverterswpf.dll
    Filesize

    137KB

    MD5

    a56a73b39703d5ff85b5cf12f9b00009

    SHA1

    e6448c87f969e19ae4c6514d69d8286d26a2b5db

    SHA256

    bb5966185017d904d2d7fd952bcc6d5c19fdf6bbbe34ab29c63a3784cd1074c7

    SHA512

    7fa07a1fcc0735186ee71b3c123b1c4076f04dba5ad319588ea695ef117ab7c39918593e4ee42f18cbd3fe01d043e896981ca6f07293fc2fb0a9bce5d66992b5

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectorcore.dll
    Filesize

    201KB

    MD5

    24e3b7177eeabdf085a01796b49c8e55

    SHA1

    6916a0bb98892252f59692fd0405e6da62af0f8b

    SHA256

    eab963926cf2d62b575c6f33804372fea04db328b2b3f0adfb45fee3f27e5386

    SHA512

    5e377e609673f3d84e22d070012578b8a18fce848a3815d9da05e10043d3e9fde8070094d1841acb44a4f876d8741e371a5fbcc86cce80cdf826131370a41e64

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectorcss.dll
    Filesize

    109KB

    MD5

    726d04bbe783a3510b18a491adac05c0

    SHA1

    11a01c68204dd80b32c01dcdb2e51f5b0ee34d98

    SHA256

    639e091c9e87986eaf9fe00f0f401834e14878ebc48084697fd4307713a065ca

    SHA512

    90592ddef83b6640cf8f28f0818098f95acc4139c7b3f5e8afa63bb873530be1613d42ee02dae12160737ee612187fc0139e19ee4a7f1abb3fec1fcaee1ae297

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectordom.dll
    Filesize

    55KB

    MD5

    e4f6efef27708458ecda4ee22edf3cef

    SHA1

    07ccb5fa980dead816737ad83802cbfed18e4a4f

    SHA256

    413e485d8dd07231d70107d86ee1a17ce705517aed8346b4701747d1fdbfdfc3

    SHA512

    4920e508304df14041df1189938a1102e4a71e2e57ac4b9b804b6b0405c89c8292012a5ff4dae21268204ed6d9b56a279f4ce18d709074d1cba71cc9d5e11a1d

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectormodel.dll
    Filesize

    998KB

    MD5

    225a73e5a0cf87453832b578db6daddb

    SHA1

    a36717a1b2c7eb2ba160fec5fa80e48b9e57c4ac

    SHA256

    0499708762c56b9339c980e731ffab294e9b18362af3dcb4ad4481f1c7bd60c1

    SHA512

    565ee2105bd626650857e0e6f9c8f7d87a68c3ec41923de119a3b710038a4785e16ccf79feb4c1c4f8a308f682163089228ac4ac81295cea754ae1189311c965

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectorrenderingwpf.dll
    Filesize

    203KB

    MD5

    faec58e7785c287a7c688f274207048d

    SHA1

    66c038c720035b7212a7d3733da4520e3b95d63b

    SHA256

    4c76dd0441a8021a308be24cf0c1957bee280451abcc1467acf47f1a6f7f5dce

    SHA512

    9269a91a5bab01f076d8e9fde2991463fb224dc6382f8cde3a118e83cb35bdf580b4ea7686f2ea767a2a9c04650222edfc3a8b2569978b734c51b7135915448e

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0D30FB966D63FE115919A6383DC215E5\sharpvectorruntimewpf.dll
    Filesize

    69KB

    MD5

    0e203d24d04e89779638dd70d5335b39

    SHA1

    98ffc3718c6e34bd6d696bbcce605db666f99b01

    SHA256

    f15b5199850b8ed98d2202972ada759823a17893a68d60ca3a0f76ee31aeb204

    SHA512

    a07f54cce2add948340807b8ecf430e72c07032332046e5dd05d9da90f7d732921c0ff628592ff0710914ec9d9b7188b46377e1594a9f9809a107a022de1cfee

    Download Submit
  • \Windows\Temp\0ABCF9966D63FE115919A6383DC215E5\2024-06-30_283a085ca603e762a0cdfeca133078d4_avoslocker.exe
    Filesize

    4.2MB

    MD5

    283a085ca603e762a0cdfeca133078d4

    SHA1

    5803a411f902ab17cb6ac5dfd4961fca8eb235a4

    SHA256

    4682f33401c6f649275c861d4f293c4a99770b72c1089529e9f893b50985e515

    SHA512

    5a988dd55c038983e5918bdce9f083eb8e10cbb47bb7ba1d3c9e916b107d486837127c6650379449b6be996270b7cf447d782a297719d32446ae732a3b00a494

    Download Submit
  • memory/2968-2-0x0000000077AD0000-0x0000000077AE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2968-0-0x0000000077AD0000-0x0000000077AE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2968-1-0x0000000077AD0000-0x0000000077AE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2996-107-0x0000000007880000-0x000000000791E000-memory.dmp
    Filesize

    632KB

    Download
  • memory/2996-40-0x00000000736FE000-0x00000000736FF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2996-101-0x00000000073B0000-0x000000000741A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/2996-96-0x00000000073B0000-0x000000000741A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/2996-88-0x00000000060A0000-0x00000000060E8000-memory.dmp
    Filesize

    288KB

    Download
  • memory/2996-84-0x00000000036F0000-0x0000000003706000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2996-112-0x0000000007880000-0x000000000791E000-memory.dmp
    Filesize

    632KB

    Download
  • memory/2996-80-0x0000000003BE0000-0x0000000003C22000-memory.dmp
    Filesize

    264KB

    Download
  • memory/2996-134-0x0000000003A30000-0x0000000003A3A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2996-135-0x0000000003A30000-0x0000000003A3A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2996-133-0x0000000003D70000-0x0000000003D92000-memory.dmp
    Filesize

    136KB

    Download
  • memory/2996-129-0x00000000064D0000-0x0000000006504000-memory.dmp
    Filesize

    208KB

    Download
  • memory/2996-52-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-125-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-51-0x00000000031F0000-0x0000000003236000-memory.dmp
    Filesize

    280KB

    Download
  • memory/2996-47-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-44-0x0000000000ED0000-0x0000000000EDE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2996-92-0x0000000008080000-0x0000000008340000-memory.dmp
    Filesize

    2.8MB

    Download
  • memory/2996-8-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2996-173-0x0000000008C80000-0x0000000008D7A000-memory.dmp
    Filesize

    1000KB

    Download
  • memory/2996-162-0x00000000069D0000-0x0000000006A02000-memory.dmp
    Filesize

    200KB

    Download
  • memory/2996-197-0x0000000003D10000-0x0000000003D2C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/2996-201-0x0000000003F30000-0x0000000003F3E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2996-9-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2996-10-0x0000000077AC0000-0x0000000077AD0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2996-205-0x0000000006550000-0x0000000006562000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2996-217-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-230-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-231-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-232-0x00000000736FE000-0x00000000736FF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2996-233-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-234-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-235-0x0000000003A30000-0x0000000003A3A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2996-236-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-237-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2996-238-0x00000000736F0000-0x0000000073DDE000-memory.dmp
    Filesize

    6.9MB

    Download