Analysis
- max time kernel
4294210s - max time network
138s - platform
windows7_x64 - resource
win7-20220311-en - submitted
20/03/2022, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
SusLocker.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SusLocker.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target SusLocker.exe
- Size 279KB
- Sample220320-m2sl6abhd3
- SHA256 4fe81b8a0a09246218ba83f8f519c4edc7ed579d786865c2c56f6a386bf40b43
- MD5 8d5cef4eb91bf64fef25150ca1d32b6f
- SHA1 58b2f1152e825fb7dc5e9e70d820ebe150d074ac
- SHA512 f2036e436a953e7b34338f18dedffad3e7c42e9484bf8e9ac2be0ce67edd5eee0d74ab17fba3a64ebf0607c494c34d3a8fe6f19a5d728d0ab7239147ecdddcad
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini SusLocker.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 964 AUDIODG.EXE Token: 33 964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 964 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SusLocker.exe"C:\Users\Admin\AppData\Local\Temp\SusLocker.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
PID:1248
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:704
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1801⤵
- Suspicious use of AdjustPrivilegeToken
PID:964