Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
06/06/2024, 16:47
General
-
Target
2024-06-06_10eae49c87155bf9cf0962632bfe9f7b_avoslocker.exe
-
Size
1.3MB
-
MD5
10eae49c87155bf9cf0962632bfe9f7b
-
SHA1
da0a50f9600276c68d8994cf2ba54721991ac2f2
-
SHA256
bd5fdd72953e70e94a99626382d963c2f5aa82c4ef1ece4ae7f653900ab00745
-
SHA512
90297ec093ae008fdb8ac1e37afd4980c7ed5098591525bd2b99ed533b8044280e34d64a2428fef328ee16985d7d69b832f4e00425e0935a2b39a11e8f1201f4
-
SSDEEP
24576:t2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedTu6JIx2RBAmAWYb18Qn:tPtjtQiIhUyQd1SkFdnIufA8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_10eae49c87155bf9cf0962632bfe9f7b_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_10eae49c87155bf9cf0962632bfe9f7b_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5973fc17a0932c2417cc3fa2ae374c324
SHA17e76504e7d3f9fad5d7c800f850c09ef92f0cdc7
SHA256c69d279fa32f18e90c7a9a3183d337f25a76248b72bfa9440187daba5d22cb7c
SHA512ea78a7baf34e99102d7d7203639791fafc60ba878628ba7ecf04cf0fc94177f70e732d4de2790b78fef8c6bf28d7717e41104651cac8cfdc74d245699a1bff20
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
680KB
-
Filesize
680KB