Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/05/2024, 21:31
General
-
Target
2024-05-30_b5c374e458f4b41597d68c6a122d2b52_avoslocker.exe
-
Size
1.3MB
-
MD5
b5c374e458f4b41597d68c6a122d2b52
-
SHA1
9b6f73b7f4895b025e4109793c361e6587c0f2fb
-
SHA256
ad4dc3bb7da685e94c5a6e7acc086290819ac7a12943b67c0e889a613de1ad6b
-
SHA512
9d50c6acfe9cc5b1660cab5f9d80e1b3e59f0919ce1a5b8f86fc4fcffdef7a18259a51332427fc3007a4090afd3b68fe3e49901415e2364aeed895f0a5c9c7aa
-
SSDEEP
24576:k2zEYytjjqNSlhvpfQiIhKPtehfQw99qySkbgednW+vxWJq0Q7QqtWLjXTqM:kPtjtQiIhUyQc1SkFdW+pWAV7QqejX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_b5c374e458f4b41597d68c6a122d2b52_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_b5c374e458f4b41597d68c6a122d2b52_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD572ddc9a210978ffa047ec860f7ac3b2a
SHA19878b1cccb050c5a4545de335933035ad6708d4d
SHA2560c9d2eafdfde9e8fd95b7e7f658a05cc711b7173947be4f15e02212751160fea
SHA51251afd01f1ee5e8c912ab0f0120f132c509d46a0b2ebea425ea9050f7efd2191ab49d04a44f814901548005ee55442d99dc718d5476a475bc3153094700b90c55
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB