File name:

Avos Locker.exe

Full analysis: https://app.any.run/tasks/b1cb5bc1-79cb-4d7a-9421-715ec6fc401a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: February 17, 2024, 17:02:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

FB9FE1400B5BD07337E80985147D0521

SHA1:

32BF972E0B352D5455E0336737A504D2819402A4

SHA256:

EC955F589F25D0D28E55964A1AA79C27492026982994CD4CA1FAF7E8A78DB4BC

SSDEEP:

24576:A8GfIZr+gcUxHHrRGVr+/+azwsWPxOJa6tAhp53R6aWpxKXUTWkhghYnBiuXKlhM:A8GSr+jmH9GVr+/+azwsWPxOJa6tAhp4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Avos Locker.exe (PID: 3240)

    • Deletes shadow copies

      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 3652)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 3536)
      • cmd.exe (PID: 3348)

    • Renames files like ransomware

      • Avos Locker.exe (PID: 3240)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Avos Locker.exe (PID: 3240)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3692)
      • Avos Locker.exe (PID: 3240)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 2424)

    • Uses RUNDLL32.EXE to load library

      • powershell.exe (PID: 2424)

    • Reads the Internet Settings

      • WMIC.exe (PID: 2124)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 2424)

  • INFO

    • Reads the computer name

      • Avos Locker.exe (PID: 3240)

    • Reads the machine GUID from the registry

      • Avos Locker.exe (PID: 3240)

    • Checks supported languages

      • Avos Locker.exe (PID: 3240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:11:06 03:19:15+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 636928
InitializedDataSize: 198656
UninitializedDataSize: -
EntryPoint: 0x337fd
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
14
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start avos locker.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs vssadmin.exe no specs bcdedit.exe no specs powershell.exe no specs bcdedit.exe no specs powershell.exe no specs reg.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124wmic shadowcopy delete /nointeractiveC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2160cmd /c wmic shadowcopy delete /nointeractiveC:\Windows\System32\cmd.exe—Avos Locker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2147749908
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2292vssadmin.exe Delete Shadows /All /QuietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2364powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2424powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Avos Locker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
3128"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\admin\AppData\Local\Temp\2061566230.png /fC:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3240"C:\Users\admin\AppData\Local\Temp\Avos Locker.exe" C:\Users\admin\AppData\Local\Temp\Avos Locker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\avos locker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3348cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\cmd.exe—Avos Locker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3536cmd /c bcdedit /set {default} recoveryenabled NoC:\Windows\System32\cmd.exe—Avos Locker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3652cmd /c vssadmin.exe Delete Shadows /All /QuietC:\Windows\System32\cmd.exe—Avos Locker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
240 787
Read events
240 787
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
120
Text files
1
Unknown types
7

Dropped files

PID
Process
Filename
Type
3240Avos Locker.exeC:\Users\admin\Pictures\guidesspecial.jpgbinary
MD5:8C718ED2DAB0763288F5860FE73191BD
SHA256:D991933BE29C5CEACE5857D193E136CB6A349E081E5B8388020925FE0956BF75
3240Avos Locker.exeC:\Users\admin\Searches\Everywhere.search-ms.avos2binary
MD5:676A87361EBE739696B901F79D1400EE
SHA256:B723C972B749CC766F61707BC8EE3A99F6D2ABCD591F2BD2F9D52FC75B5F1E6A
3240Avos Locker.exeC:\Users\admin\Pictures\kindagree.png.avos2binary
MD5:5B0DD18E94CED70EBCB1715B7C69DB9C
SHA256:CC7AA866CC206F91FA950614157D7824AB9D99E5DFCBB99B721402FA007F5438
3240Avos Locker.exeC:\Users\admin\Pictures\moderoot.jpgbinary
MD5:F8BC31CFA3E6CBD8D6A3738F03FE8625
SHA256:4AC6B226A7FB5AAA22575CB4EA1647F871217C9911A565F5350198EE481834FF
3240Avos Locker.exeC:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.avos2binary
MD5:B2FD6F61802A5A521EEDA8C0F36FD971
SHA256:911289E35A40F1A5E3DEE2C4665B1AC8B8B02EC66D0F223A44D265D6647A2E09
3240Avos Locker.exeC:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.avos2binary
MD5:CC8218039BD9D24A1ABAA8068A2ED8C5
SHA256:17BD4DD35BFFBA5EB843881D102BB54B3DF9540482D9F6B02F8A2976CA24BF31
3240Avos Locker.exeC:\Users\admin\Searches\Microsoft Outlook.searchconnector-msbinary
MD5:B2FD6F61802A5A521EEDA8C0F36FD971
SHA256:911289E35A40F1A5E3DEE2C4665B1AC8B8B02EC66D0F223A44D265D6647A2E09
3240Avos Locker.exeC:\Users\admin\Searches\Indexed Locations.search-msbinary
MD5:558AACA1F7D65AF61829E36925C610FA
SHA256:FE139A3B112EA72DFFA82E9F9DAE67B69E6009F2C06C403082FFDFED2E2AE746
3240Avos Locker.exeC:\Users\admin\Favorites\MSN Websites\MSN.urlbinary
MD5:B4DF28BA82FC3DCB6D7EF3C2D9B685C9
SHA256:28E87C62FC630069D0CF42351F06E3FC9AECE12385CEC8A320AA2CBA6CAAFA3B
3240Avos Locker.exeC:\Users\admin\Pictures\guidesspecial.jpg.avos2binary
MD5:8C718ED2DAB0763288F5860FE73191BD
SHA256:D991933BE29C5CEACE5857D193E136CB6A349E081E5B8388020925FE0956BF75
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Avos Locker.exe