Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09/07/2024, 16:42
General
-
Target
2024-07-09_e4ec5eb7cee4db24f26bfacd1093070f_avoslocker.exe
-
Size
1.3MB
-
MD5
e4ec5eb7cee4db24f26bfacd1093070f
-
SHA1
4c86382ac0b4262641f8bdaf5319785039982dfe
-
SHA256
0c065d21f7ffec6da1938651629c9f1ccb24e4ffd6de8cfe92fb52f9e84cfce0
-
SHA512
c689c860b4f60203193f504ffc30842a078a86c363c0c3249d0509d77e5c94d60c8de9e229a2be95d62ad6437509edbcf21cabe41a674ed1c833d2536d70d2c6
-
SSDEEP
24576:w2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedpUOoTqy8QCYrLLeYKUML:wPtjtQiIhUyQd1SkFdp/ouy8grLLesK
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_e4ec5eb7cee4db24f26bfacd1093070f_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_e4ec5eb7cee4db24f26bfacd1093070f_avoslocker.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.3MB
-
Filesize
1.3MB