Analysis
-
max time kernel
4294210s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
20/03/2022, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
SusLocker.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SusLocker.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
SusLocker.exe
-
Size
279KB
-
MD5
8d5cef4eb91bf64fef25150ca1d32b6f
-
SHA1
58b2f1152e825fb7dc5e9e70d820ebe150d074ac
-
SHA256
4fe81b8a0a09246218ba83f8f519c4edc7ed579d786865c2c56f6a386bf40b43
-
SHA512
f2036e436a953e7b34338f18dedffad3e7c42e9484bf8e9ac2be0ce67edd5eee0d74ab17fba3a64ebf0607c494c34d3a8fe6f19a5d728d0ab7239147ecdddcad
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini SusLocker.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 964 AUDIODG.EXE Token: 33 964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 964 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe 1248 SusLocker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SusLocker.exe"C:\Users\Admin\AppData\Local\Temp\SusLocker.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
PID:1248
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:704
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1801⤵
- Suspicious use of AdjustPrivilegeToken
PID:964