Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
15/05/2024, 23:44
General
-
Target
2024-05-15_1edbb2b580ddb159e09aeac871e7e0a7_avoslocker.exe
-
Size
1.3MB
-
MD5
1edbb2b580ddb159e09aeac871e7e0a7
-
SHA1
40f83597be62616ea0611a5844cd55820c1ce469
-
SHA256
39ee390a79d4900701a9c1542dee39982da18b9dbb324d6685504a4bf7166d9d
-
SHA512
26716f461240d71f2a065791e340858787948de3eec01f80970ef4161a34c93c7556cab219cbbce27540a310a93349c70fe28317d11fafd6f3a441c9ecb86ef8
-
SSDEEP
24576:p2zEYytjjqNSlhvpfQiIhKPtehfQwM9qySkbgedw6LaRFdGJm0Q3WKVSwdr13Ekb:pPtjtQiIhUyQj1SkFdw6KFdi2Ga9x3EJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_1edbb2b580ddb159e09aeac871e7e0a7_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_1edbb2b580ddb159e09aeac871e7e0a7_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5ecf8d80c11d41fa548378cb69171e07e
SHA1fcc4f1f1aa5a00eb5a1f9afc893c1741d85339ea
SHA2561c753d5fa6345ea8b2d0c2259239af911090d08ee32683cbef3573ab130ac056
SHA512fd9bbb70b18fe30be990a62286458b9b8bd80f8ba992c77dfa65f06dafee340b31729e8f900c299dfe9d06ca343c9bc206a19690a2eee9ba62d236a01e0a5709
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB