Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04/07/2024, 17:33
General
-
Target
2024-07-04_691264b4f9e71017c44f3586070a4b7f_avoslocker.exe
-
Size
1.3MB
-
MD5
691264b4f9e71017c44f3586070a4b7f
-
SHA1
a027ea3c276c72bb833f57c82d84e7af1126aea9
-
SHA256
482977f57990f050283d46ce5c5ed2ef1af09dc87228c08f89c0d77d50b9743d
-
SHA512
2a0f0c304a8555c45cf88fb9ba965de6e1a530bbab91664f8ff8eff78cbbfeb60f7d163ccbb623e5f175e5d5c5da7af5cecd6d140c78c6616be66eb997e8a938
-
SSDEEP
24576:+2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbged3TduSZpUR0GHrVQ1aW4mSOgv6:+PtjtQiIhUyQd1SkFdJpAHrVQ1/fSNvi
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_691264b4f9e71017c44f3586070a4b7f_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_691264b4f9e71017c44f3586070a4b7f_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5a821e0ad6fe89c2a535cc91b089d4a2f
SHA19b6bd2e67911c6c4309424661806976ee00dfc60
SHA2562def7fe3c32c96fdaf609d80222efe5d19ac5d54a061278773c1c399fab9072f
SHA5124447c6cb7f52005fe44506d72015c6e9dd76510a778692f2b8848914a973ec8b5e50064c44f8ae1b6eea2a8ad5de946b55e2f6a685d54f6e52205ef08c1ae81c
-
Filesize
1.3MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB
-
Filesize
656KB
-
Filesize
656KB