Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
22-05-2024 22:33
General
-
Target
2024-05-22_ee24766f32b85978aa6e5ff85851cf48_avoslocker.exe
-
Size
1.3MB
-
MD5
ee24766f32b85978aa6e5ff85851cf48
-
SHA1
c09dae31f4c5698b34d27b834de34270e8fbbe83
-
SHA256
ee2d68974e8c3c1a8bb20488477fde19048b997cd81ba22f1cf7879ba5677add
-
SHA512
c5a007ba1d7596f33d9dd9adb456ec52cc80d42744fd31cfe2264360d5d0d2824c1b1c32268c6c77b7bda9502263b5c02280f79160b5c1fe38cb9e21fc77d5ed
-
SSDEEP
24576:J2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedGW+vxWJq0Q7QqtWLjXTqM:JPtjtQiIhUyQd1SkFdf+pWAV7QqejX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ee24766f32b85978aa6e5ff85851cf48_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ee24766f32b85978aa6e5ff85851cf48_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD57127446a8446e35b29b912f80b670ced
SHA13b4c1c02b9f3e1022a53730f9035bf146ec6ed35
SHA256cd5ef14ad204354c07bf2a2b7f797cb70662b7246d5dfb399d57450b7193e2c4
SHA5129978fe03bfa0b7c91dd0ef2af782d2f539e68df6f4056be58fc489c4bae7436276884e6264f6e310c6b0643cb9b21748ea3dad57652b1a48bafe021b64b0a1ed
-
Filesize
412KB
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
1.3MB
-
Filesize
656KB
-
Filesize
656KB