Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-04-2024 10:58
General
-
Target
2024-04-28_44936638e583bdfec2660ff6e99fe6e7_avoslocker.exe
-
Size
1.3MB
-
MD5
44936638e583bdfec2660ff6e99fe6e7
-
SHA1
38314b0ff5305c3d8b71856b95bc8ddf2a7b6a48
-
SHA256
1f053b550c6e930fc8eca953e93d3434ae6786b18aae44f91c098b5a56e56d53
-
SHA512
662bd6bb6bbb8e751d20f08a8df64b7dc6afaeff5c302e11e51dc425123194ce52e6b8d018d70db59d04caf6350ca4d3d2e4444b35373ea810d6fe1e6c2b9c74
-
SSDEEP
24576:K2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedQRVldlnXfH9gPwCn7vOb7HHcg:KPtjtQiIhUyQd1SkFdQRVlbnXf9gPTTg
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_44936638e583bdfec2660ff6e99fe6e7_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_44936638e583bdfec2660ff6e99fe6e7_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB