Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/05/2024, 17:29
General
-
Target
2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe
-
Size
1.3MB
-
MD5
4f5244a9591477595bdeb8217120e018
-
SHA1
3940ef788fc5fc71cb709567c326f79887cc0860
-
SHA256
b3af46812cf78d5db8220306c983798909a4fb52aba337f58664fe91122b3ea8
-
SHA512
584c8f369609b83ccca1dc1fc87077c49a216310aada6e1eee9baec09feb5d24a4696ffbf7dc6e794da8b524492ab1e504764c75a12a69b8724232f849d545d1
-
SSDEEP
24576:W2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedqaHsK+fM2jEaNZBqoeW7V6tGX:WPtjtQiIhUyQd1SkFdqksDM2jh3BqS7z
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5a35c35eadcd0a72fabd94192a9712eb4
SHA15e474c189defd4bf2ca741f601549de8b2ab09e0
SHA2563fd929df8df840f44030a1788ad2515b8d6e209ed738acd673c4764ef04b1648
SHA5126c7d1fe19dfc6dbce046739aab9b1ec86798dcef273f9c0455308394d5883109cf4853b2d86a21f0778e09c8fc9f465cfb9d0d92d063d8a16ba936a62f7d7d7e
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB
-
Filesize
656KB
-
Filesize
656KB