8d0a45b844f057146fe481a0b34a754ce018aa068fb248d64a210024c49ddda2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 11:23

Target

2024-05-02_0ea2658f440bb05e2bd0d11dd20dac0f_avoslocker_cobalt-strike.exe
Size

946KB
MD5

0ea2658f440bb05e2bd0d11dd20dac0f
SHA1

939d7434bbbce89b18cb9c0cfb52d00029790c57
SHA256

8d0a45b844f057146fe481a0b34a754ce018aa068fb248d64a210024c49ddda2
SHA512

ebf3ac5aff3aebcfc1a28dc198588cdfd218a2739b004bc33bbe60ab57e83777bdd781e4060d6cff868ce5f9f1e75719d793ba55564017fdaeb2568cc78115bc
SSDEEP

12288:XFGizO96l5p1hgTOPrGYDfJtW7C8z2eYFKYKOQKQ95uEPZugK6bbColckM008A:XFFOY5p1+ydfGCKOQKohbCoWVB8A

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	2024-05-02_0ea2658f440bb05e2bd0d11dd20dac0f_avoslocker_cobalt-strike.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-02_0ea2658f440bb05e2bd0d11dd20dac0f_avoslocker_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_0ea2658f440bb05e2bd0d11dd20dac0f_avoslocker_cobalt-strike.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1844