Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
15/05/2024, 17:29
General
-
Target
2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe
-
Size
1.3MB
-
MD5
4f5244a9591477595bdeb8217120e018
-
SHA1
3940ef788fc5fc71cb709567c326f79887cc0860
-
SHA256
b3af46812cf78d5db8220306c983798909a4fb52aba337f58664fe91122b3ea8
-
SHA512
584c8f369609b83ccca1dc1fc87077c49a216310aada6e1eee9baec09feb5d24a4696ffbf7dc6e794da8b524492ab1e504764c75a12a69b8724232f849d545d1
-
SSDEEP
24576:W2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedqaHsK+fM2jEaNZBqoeW7V6tGX:WPtjtQiIhUyQd1SkFdqksDM2jh3BqS7z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_4f5244a9591477595bdeb8217120e018_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5011f2ee26cb2867bd910fcc598729861
SHA1a907d2a52de6562070b80aa81b49861fe9f4e0e4
SHA256f6afa2acdd84d85f596d64d4a9f079e980792164e3f4da20013006cb569aaa53
SHA512dee759d6cce9c2648503505b19a66965528a07a6be4c3a3e7d292f1b237272df50960c5ff04f61d9d257674db78eca0c7f6d3e00e096c3977fabdf8d7fd42e85
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB