Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/05/2024, 16:53
General
-
Target
2024-05-16_5afd6e6caa3e58d7f7f897284679d06a_avoslocker.exe
-
Size
1.3MB
-
MD5
5afd6e6caa3e58d7f7f897284679d06a
-
SHA1
b7c0e7b0b5d1a2d486da6566c0c56846022550d2
-
SHA256
374d82797ff5c9fa87f687f60a26b5e1bdae25e793318ec87f28ebeed19fcd97
-
SHA512
5d262156f52eabe644aa222db8b10bf570621d36d8572b117633abf4ec0eb4db91e63365bd6c513acc8c5a42fe523782d3f429748635eed7fa2338dd7b02d465
-
SSDEEP
24576:c2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedlbl0fitGbna8FLk2m1X2D4brr:cPtjtQiIhUyQd1SkFdlblI7a8K2mFhbX
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_5afd6e6caa3e58d7f7f897284679d06a_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_5afd6e6caa3e58d7f7f897284679d06a_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB