Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/05/2024, 10:25
General
-
Target
2024-05-26_09bafaeaae706582bdb3201c872aaabb_avoslocker.exe
-
Size
1.3MB
-
MD5
09bafaeaae706582bdb3201c872aaabb
-
SHA1
332ed2fac1637d43a6f3528ffce7da34a01cd364
-
SHA256
1878fbfb09b35117221268736489a5056f73d8b0d60579eb615240ecc31ebe92
-
SHA512
b5543b64b4eb12d341bbf59d99e332e2abc362b98db010952bc092a7b3643de0443dec6e25770de6d48d224762d0804153dc87fe812062c9b58fc43574298e49
-
SSDEEP
24576:02zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedDWHRlMugdD+JsRgZRJ4fM430G:0PtjtQiIhUyQd1SkFdixlMPdlR8v4UCo
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_09bafaeaae706582bdb3201c872aaabb_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_09bafaeaae706582bdb3201c872aaabb_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.7MB
-
Filesize
1.3MB
-
Filesize
1.7MB