Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/05/2024, 22:09
General
-
Target
2024-05-29_fc2a441f03c998290ac7d24e764195ff_avoslocker.exe
-
Size
1.3MB
-
MD5
fc2a441f03c998290ac7d24e764195ff
-
SHA1
34a940f8c4cb87fd6d14e83bf6c3b28393237f2d
-
SHA256
5c746e2287dd35282f1b5cb04088758b622e4e22e29930bee9f2ef6387ee016a
-
SHA512
2d9a2f66d4cabd178e8c7a857a95bf5d113217d5ee48b3b2f1fe3ecac745a7d023f0f5ad8b187e8fab3c85468ce9e79c61e6dfdabc417b98962daaaa36006956
-
SSDEEP
24576:y2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedygPvod50p/TXM2s0espsODZjV:yPtjtQiIhUyQd1SkFdy0vo05s0eusONx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_fc2a441f03c998290ac7d24e764195ff_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_fc2a441f03c998290ac7d24e764195ff_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d8af4ccc01ed75d6055bcf07dc175eb0
SHA17ed9713c4a08849f7579baf577e5ed4a9cbe7e23
SHA256cc1dd2fff190cda34ce0f11aaf0882e3ea9049c0895c6d25b6959e98e7c72d12
SHA512ff9cc86685dd8f5a1366bc56a3a482bff077813c98cfa505719b59a04fe7d985c8b51137069af5ca28a0d660b5cf17ddc9713a288b167d05a89f5d0663fc8dd2
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB