cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46

General

Target

Avaddon Ransomware.exe
Size

719KB
MD5

275e4a63fc63c995b3e0d464919f211b
SHA1

51d85210c2f621ca14d92a8375ee24d62f9d7f44
SHA256

cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46
SHA512

1723fb4a624859cb49f1d00100a44c5104a8a6ee4685b0e0988fa54f929dc7d70d171034577a17db2e6529d6c19b49d2ba023c4c98e9637f92981a3c1a5c9dac

Score

10^/10

ransomware evasion trojan persistence

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\LwZt1_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .adDAaaDeCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUpaRjQ3NTRpcFQ2MTVRTDZNWFZQV3J5MHdoVmVLdXVkdXBGTEYxT2w2N1lIeUgzRkhKUDZjWEVuOUZIaXl4clF1dGY3NEVmUndaR3JYa3lpNS90NXpVL3lqakFWbzRrRlc3OEs1YkZwYmNxREFBS0xXcHdaY2xIdnhpdzE4RjRyQzJNQVl4WW1naEhjU0RLYXZsOWR1aWE4VmhXREZoQnFYUk50bERoNGpXUThsaHFLYW9DRXA2WUxlL2RFUDlpcWlUV2VWbVRmRERtc2dhQm9YdVJYemNLZUpIbUxEQnlUcTgzRkFNWmVEUXFiMDVQVzAyMVNyQVV6MmJnNldBQThZNzB1MlBrWFhOWEVlMTg0b1AybExRYXMxN3c4enlGTXRCSzZhRmVJV05pcUhuandjYTFjTXJTL2Y2STdIN0UzelpjWU5HeHN3ODlyS2hrY0M0MklENWswV2xhTUNockRBeXBQNTVXNmRnNDlraWdJYnpGckI2Zmh0a3lubEVBZXR1TTZDN2MvczdBazZOSXdqbFNZMGdnV3RzQ2RzbTVIQkRIbmMzUXptUWhHU2E3TUNGczRHT1h4WUtzZEp2SVc0ellRdGF2N0pCMnExTEczTXo5VXlVRTdmTzJJaExNNzM1NHl1cmlYNVA2M3JFdXYzcWxLa09iQ043WGsxTnVJZEtFYVZFRTM2MEF0Vy85Ymd1UG1WblY2TEtKQm9kNW1VUlkyem1iVXRBbmI0b2NURkRqSU5Cd0d5UEFzZXhPZXZ3NHNuTXFmZWx2Rm5uQ0M4dEViQkFpeUxGUFNsLzNvOTlyZ2pSK1d3KzhQSXFKUWRLSWF3YnQ3WkZDckJkd1dxUkF3K0dMb0VRcmk4YUpORHN2amwxU2k5azhxR3pucDdVRUt6WjNOYy8zWGFpdzRZZzhXZndoMHp4OFFkQlNFUFh4OTVTalVPYW13NWQweEdoblI4RndxdkdMNFFnaVhtdVJ0VDFvbEFVQmgwNG5NMVMwR2l6K1loY1B1blJGYnFEcjZkQmFMUzlITG85ZHhoR1JjUTZhV1JBV3lERFFuWjU3UDlkMDFyUGdONm1nZUFPQ1BHVDRaT1RXSHVxa2FpUWZDUFVxL2liRy90eDh1OTkzbGEzcEdJV1JhbDZMWkxKMTdSeDdXenRFQXVmLzUzVGxHZHJvcEQ2U1ZGdlVkRCt5NUtmd2h2YXovMzQ1RThxc0E3S1RSV1BsV09aT01QRk9HNVZMeldrWG9veHNoYjVWQ25WS29jalZWUjN0cXdPUzYrL1hsRC90Qndja25NTi81ZlhlRzhPZVplRzJ5a0VnUzhJT21nUUthd2RFbndzQmVieWpqMlRWeGIxNThueTB0THhJWkIyWk16NHdIN1JvbU96N0p2K2RmVUs0OStzOVNSdStjMDUyOVdaOEk0UjdkcHdEN3ZOOGJDK05jMmJJdnQ4V3hDWEh4Q2RraTh2V0dka3huUEZhUmtadmRwNXBVa09RRGlscVIrMkxiQmd3UVcyLzNKbzVjaGRxc0V0VlVmWE80VVpteE52ZEltdGpVRDF6bXpIUlVSQ2dueHMxYnExanIydCsxRnZNT0dEUjhyeFkyb1hKM1NZWnNpT0JRbWUxQVFZdjl5UjNldTg0MWNhSm41ZzFkWW1xdHJ0UmVJZ0Y4QmtaOUpITzFGNDBLL1lGTEFQYWwzN2x6UE11V0pzTVAwc09MNFhGMWl0djZmZUZWbjVmblJSVnhldUEzNHdyK2RMQmxVLzRkcW5rOVYxMy92cHA2M3o2SFZudERodzN2ZkhwUndqUW1KL3hqN3lZa1dFam82VHQ2TnpIdHU1Q3ZUTHVPTkZMWnFoY3hqSXBUbWZnbkZiTDllaWxKdEM2RFluekJMMGtuNExQc1NaQkZtTEdlcm1jYzlNOXdHOVNWbkQrQXUrNjNsb2xKRzQvT0tXc3BGMHRrQWFiTjVwK0VXWnlKRndJemlna0RkRm5UZml0WTlrTVhqYmtBNGc3cmEvRFhoamkwSEQ5QmE1MENCbmFtWHFzYzNmT1QxMFBFMFhzTUVSdGRCVnE3WkRSNmw3VXc1aDZBWVFvc3EyMW12YTQ9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 725ghpBBgBvRDsc

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Documents\LwZt1_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .adDAaaDeCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUpaRjQ3NTRpcFQ2MTVRTDZNWFZQV3J5MHdoVmVLdXVkdXBGTEYxT2w2N1lIeUgzRkhKUDZjWEVuOUZIaXl4clF1dGY3NEVmUndaR3JYa3lpNS90NXpVL3lqakFWbzRrRlc3OEs1YkZwYmNxREFBS0xXcHdaY2xIdnhpdzE4RjRyQzJNQVl4WW1naEhjU0RLYXZsOWR1aWE4VmhXREZoQnFYUk50bERoNGpXUThsaHFLYW9DRXA2WUxlL2RFUDlpcWlUV2VWbVRmRERtc2dhQm9YdVJYemNLZUpIbUxEQnlUcTgzRkFNWmVEUXFiMDVQVzAyMVNyQVV6MmJnNldBQThZNzB1MlBrWFhOWEVlMTg0b1AybExRYXMxN3c4enlGTXRCSzZhRmVJV05pcUhuandjYTFjTXJTL2Y2STdIN0UzelpjWU5HeHN3ODlyS2hrY0M0MklENWswV2xhTUNockRBeXBQNTVXNmRnNDlraWdJYnpGckI2Zmh0a3lubEVBZXR1TTZDN2MvczdBazZOSXdqbFNZMGdnV3RzQ2RzbTVIQkRIbmMzUXptUWhHU2E3TUNGczRHT1h4WUtzZEp2SVc0ellRdGF2N0pCMnExTEczTXo5VXlVRTdmTzJJaExNNzM1NHl1cmlYNVA2M3JFdXYzcWxLa09iQ043WGsxTnVJZEtFYVZFRTM2MEF0Vy85Ymd1UG1WblY2TEtKQm9kNW1VUlkyem1iVXRBbmI0b2NURkRqSU5Cd0d5UEFzZXhPZXZ3NHNuTXFmZWx2Rm5uQ0M4dEViQkFpeUxGUFNsLzNvOTlyZ2pSK1d3KzhQSXFKUWRLSWF3YnQ3WkZDckJkd1dxUkF3K0dMb0VRcmk4YUpORHN2amwxU2k5azhxR3pucDdVRUt6WjNOYy8zWGFpdzRZZzhXZndoMHp4OFFkQlNFUFh4OTVTalVPYW13NWQweEdoblI4RndxdkdMNFFnaVhtdVJ0VDFvbEFVQmgwNG5NMVMwR2l6K1loY1B1blJGYnFEcjZkQmFMUzlITG85ZHhoR1JjUTZhV1JBV3lERFFuWjU3UDlkMDFyUGdONm1nZUFPQ1BHVDRaT1RXSHVxa2FpUWZDUFVxL2liRy90eDh1OTkzbGEzcEdJV1JhbDZMWkxKMTdSeDdXenRFQXVmLzUzVGxHZHJvcEQ2U1ZGdlVkRCt5NUtmd2h2YXovMzQ1RThxc0E3S1RSV1BsV09aT01QRk9HNVZMeldrWG9veHNoYjVWQ25WS29jalZWUjN0cXdPUzYrL1hsRC90Qndja25NTi81ZlhlRzhPZVplRzJ5a0VnUzhJT21nUUthd2RFbndzQmVieWpqMlRWeGIxNThueTB0THhJWkIyWk16NHdIN1JvbU96N0p2K2RmVUs0OStzOVNSdStjMDUyOVdaOEk0UjdkcHdEN3ZOOGJDK05jMmJJdnQ4V3hDWEh4Q2RraTh2V0dka3huUEZhUmtadmRwNXBVa09RRGlscVIrMkxiQmd3UVcyLzNKbzVjaGRxc0V0VlVmWE80VVpteE52ZEltdGpVRDF6bXpIUlVSQ2dueHMxYnExanIydCsxRnZNT0dEUjhyeFkyb1hKM1NZWnNpT0JRbWUxQVFZdjl5UjNldTg0MWNhSm41ZzFkWW1xdHJ0UmVJZ0Y4QmtaOUpITzFGNDBLL1lGTEFQYWwzN2x6UE11V0pzTVAwc09MNFhGMWl0djZmZUZWbjVmblJSVnhldUEzNHdyK2RMQmxVLzRkcW5rOVYxMy92cHA2M3o2SFZudERodzN2ZkhwUndqUW1KL3hqN3lZa1dFam82VHQ2TnpIdHU1Q3ZUTHVPTkZMWnFoY3hqSXBUbWZnbkZiTDllaWxKdEM2RFluekJMMGtuNExQc1NaQkZtTEdlcm1jYzlNOXdHOVNWbkQrQXUrNjNsb2xKRzQvT0tXc3BGMHRrQWFiTjVwK0VXWnlKRndJemlna0RkRm5UZml0WTlrTVhqYmtBNGc3cmEvRFhoamkwSEQ5QmE1MENCbmFtWHFzYzNmT1QxMFBFMFhzTUVSdGRCVnE3WkRSNmw3VXc1aDZBWVFvc3EyMW12YTQ9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * TfC321yU2nd0ZIGZBhU

URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\LwZt1_readme_.txt

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .adDAaaDeCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LUpaRjQ3NTRpcFQ2MTVRTDZNWFZQV3J5MHdoVmVLdXVkdXBGTEYxT2w2N1lIeUgzRkhKUDZjWEVuOUZIaXl4clF1dGY3NEVmUndaR3JYa3lpNS90NXpVL3lqakFWbzRrRlc3OEs1YkZwYmNxREFBS0xXcHdaY2xIdnhpdzE4RjRyQzJNQVl4WW1naEhjU0RLYXZsOWR1aWE4VmhXREZoQnFYUk50bERoNGpXUThsaHFLYW9DRXA2WUxlL2RFUDlpcWlUV2VWbVRmRERtc2dhQm9YdVJYemNLZUpIbUxEQnlUcTgzRkFNWmVEUXFiMDVQVzAyMVNyQVV6MmJnNldBQThZNzB1MlBrWFhOWEVlMTg0b1AybExRYXMxN3c4enlGTXRCSzZhRmVJV05pcUhuandjYTFjTXJTL2Y2STdIN0UzelpjWU5HeHN3ODlyS2hrY0M0MklENWswV2xhTUNockRBeXBQNTVXNmRnNDlraWdJYnpGckI2Zmh0a3lubEVBZXR1TTZDN2MvczdBazZOSXdqbFNZMGdnV3RzQ2RzbTVIQkRIbmMzUXptUWhHU2E3TUNGczRHT1h4WUtzZEp2SVc0ellRdGF2N0pCMnExTEczTXo5VXlVRTdmTzJJaExNNzM1NHl1cmlYNVA2M3JFdXYzcWxLa09iQ043WGsxTnVJZEtFYVZFRTM2MEF0Vy85Ymd1UG1WblY2TEtKQm9kNW1VUlkyem1iVXRBbmI0b2NURkRqSU5Cd0d5UEFzZXhPZXZ3NHNuTXFmZWx2Rm5uQ0M4dEViQkFpeUxGUFNsLzNvOTlyZ2pSK1d3KzhQSXFKUWRLSWF3YnQ3WkZDckJkd1dxUkF3K0dMb0VRcmk4YUpORHN2amwxU2k5azhxR3pucDdVRUt6WjNOYy8zWGFpdzRZZzhXZndoMHp4OFFkQlNFUFh4OTVTalVPYW13NWQweEdoblI4RndxdkdMNFFnaVhtdVJ0VDFvbEFVQmgwNG5NMVMwR2l6K1loY1B1blJGYnFEcjZkQmFMUzlITG85ZHhoR1JjUTZhV1JBV3lERFFuWjU3UDlkMDFyUGdONm1nZUFPQ1BHVDRaT1RXSHVxa2FpUWZDUFVxL2liRy90eDh1OTkzbGEzcEdJV1JhbDZMWkxKMTdSeDdXenRFQXVmLzUzVGxHZHJvcEQ2U1ZGdlVkRCt5NUtmd2h2YXovMzQ1RThxc0E3S1RSV1BsV09aT01QRk9HNVZMeldrWG9veHNoYjVWQ25WS29jalZWUjN0cXdPUzYrL1hsRC90Qndja25NTi81ZlhlRzhPZVplRzJ5a0VnUzhJT21nUUthd2RFbndzQmVieWpqMlRWeGIxNThueTB0THhJWkIyWk16NHdIN1JvbU96N0p2K2RmVUs0OStzOVNSdStjMDUyOVdaOEk0UjdkcHdEN3ZOOGJDK05jMmJJdnQ4V3hDWEh4Q2RraTh2V0dka3huUEZhUmtadmRwNXBVa09RRGlscVIrMkxiQmd3UVcyLzNKbzVjaGRxc0V0VlVmWE80VVpteE52ZEltdGpVRDF6bXpIUlVSQ2dueHMxYnExanIydCsxRnZNT0dEUjhyeFkyb1hKM1NZWnNpT0JRbWUxQVFZdjl5UjNldTg0MWNhSm41ZzFkWW1xdHJ0UmVJZ0Y4QmtaOUpITzFGNDBLL1lGTEFQYWwzN2x6UE11V0pzTVAwc09MNFhGMWl0djZmZUZWbjVmblJSVnhldUEzNHdyK2RMQmxVLzRkcW5rOVYxMy92cHA2M3o2SFZudERodzN2ZkhwUndqUW1KL3hqN3lZa1dFam82VHQ2TnpIdHU1Q3ZUTHVPTkZMWnFoY3hqSXBUbWZnbkZiTDllaWxKdEM2RFluekJMMGtuNExQc1NaQkZtTEdlcm1jYzlNOXdHOVNWbkQrQXUrNjNsb2xKRzQvT0tXc3BGMHRrQWFiTjVwK0VXWnlKRndJemlna0RkRm5UZml0WTlrTVhqYmtBNGc3cmEvRFhoamkwSEQ5QmE1MENCbmFtWHFzYzNmT1QxMFBFMFhzTUVSdGRCVnE3WkRSNmw3VXc1aDZBWVFvc3EyMW12YTQ9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * pnoPqDGIsPL5SiObqDPk09

URLs

http://avaddonbotrxmuyl.onion

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Avaddon Ransomware.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\MountRead.tiff => C:\Users\Admin\Pictures\MountRead.tiff.adDAaaDeCc	Avaddon Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\RedoUnprotect.tiff	Avaddon Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\RevokeBackup.tiff	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\PopSwitch.crw => C:\Users\Admin\Pictures\PopSwitch.crw.adDAaaDeCc	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\WatchLock.tiff => C:\Users\Admin\Pictures\WatchLock.tiff.adDAaaDeCc	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\RedoUnprotect.tiff => C:\Users\Admin\Pictures\RedoUnprotect.tiff.adDAaaDeCc	Avaddon Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\InstallBackup.tiff	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\GetLimit.png => C:\Users\Admin\Pictures\GetLimit.png.adDAaaDeCc	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\RevokeBackup.tiff => C:\Users\Admin\Pictures\RevokeBackup.tiff.adDAaaDeCc	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\InstallBackup.tiff => C:\Users\Admin\Pictures\InstallBackup.tiff.adDAaaDeCc	Avaddon Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\WatchLock.tiff	Avaddon Ransomware.exe
File opened for modification	C:\Users\Admin\Pictures\MountRead.tiff	Avaddon Ransomware.exe
File renamed	C:\Users\Admin\Pictures\JoinDisconnect.tif => C:\Users\Admin\Pictures\JoinDisconnect.tif.adDAaaDeCc	Avaddon Ransomware.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Avaddon Ransomware.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Avaddon Ransomware.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Avaddon Ransomware.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini Avaddon Ransomware.exe
Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-1400429095-533421673-2598934218-1000\desktop.ini	Avaddon Ransomware.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

2512 vssadmin.exe
944 vssadmin.exe
2068 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

pid	process
2512	vssadmin.exe
944	vssadmin.exe
2068	vssadmin.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 239874fe7480d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 614 IoCs

Processes:

Avaddon Ransomware.exe

pid	process
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe
500	Avaddon Ransomware.exe

Suspicious use of AdjustPrivilegeToken 68 IoCs

Processes:

svchost.exewmic.exevssvc.exewmic.exewmic.exe

description	pid	process
Token: SeShutdownPrivilege	1080	svchost.exe
Token: SeCreatePagefilePrivilege	1080	svchost.exe
Token: SeIncreaseQuotaPrivilege	3932	wmic.exe
Token: SeSecurityPrivilege	3932	wmic.exe
Token: SeTakeOwnershipPrivilege	3932	wmic.exe
Token: SeLoadDriverPrivilege	3932	wmic.exe
Token: SeSystemProfilePrivilege	3932	wmic.exe
Token: SeSystemtimePrivilege	3932	wmic.exe
Token: SeProfSingleProcessPrivilege	3932	wmic.exe
Token: SeIncBasePriorityPrivilege	3932	wmic.exe
Token: SeCreatePagefilePrivilege	3932	wmic.exe
Token: SeBackupPrivilege	3932	wmic.exe
Token: SeRestorePrivilege	3932	wmic.exe
Token: SeShutdownPrivilege	3932	wmic.exe
Token: SeDebugPrivilege	3932	wmic.exe
Token: SeSystemEnvironmentPrivilege	3932	wmic.exe
Token: SeRemoteShutdownPrivilege	3932	wmic.exe
Token: SeUndockPrivilege	3932	wmic.exe
Token: SeManageVolumePrivilege	3932	wmic.exe
Token: 33	3932	wmic.exe
Token: 34	3932	wmic.exe
Token: 35	3932	wmic.exe
Token: 36	3932	wmic.exe
Token: SeBackupPrivilege	196	vssvc.exe
Token: SeRestorePrivilege	196	vssvc.exe
Token: SeAuditPrivilege	196	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3020	wmic.exe
Token: SeSecurityPrivilege	3020	wmic.exe
Token: SeTakeOwnershipPrivilege	3020	wmic.exe
Token: SeLoadDriverPrivilege	3020	wmic.exe
Token: SeSystemProfilePrivilege	3020	wmic.exe
Token: SeSystemtimePrivilege	3020	wmic.exe
Token: SeProfSingleProcessPrivilege	3020	wmic.exe
Token: SeIncBasePriorityPrivilege	3020	wmic.exe
Token: SeCreatePagefilePrivilege	3020	wmic.exe
Token: SeBackupPrivilege	3020	wmic.exe
Token: SeRestorePrivilege	3020	wmic.exe
Token: SeShutdownPrivilege	3020	wmic.exe
Token: SeDebugPrivilege	3020	wmic.exe
Token: SeSystemEnvironmentPrivilege	3020	wmic.exe
Token: SeRemoteShutdownPrivilege	3020	wmic.exe
Token: SeUndockPrivilege	3020	wmic.exe
Token: SeManageVolumePrivilege	3020	wmic.exe
Token: 33	3020	wmic.exe
Token: 34	3020	wmic.exe
Token: 35	3020	wmic.exe
Token: 36	3020	wmic.exe
Token: SeIncreaseQuotaPrivilege	3544	wmic.exe
Token: SeSecurityPrivilege	3544	wmic.exe
Token: SeTakeOwnershipPrivilege	3544	wmic.exe
Token: SeLoadDriverPrivilege	3544	wmic.exe
Token: SeSystemProfilePrivilege	3544	wmic.exe
Token: SeSystemtimePrivilege	3544	wmic.exe
Token: SeProfSingleProcessPrivilege	3544	wmic.exe
Token: SeIncBasePriorityPrivilege	3544	wmic.exe
Token: SeCreatePagefilePrivilege	3544	wmic.exe
Token: SeBackupPrivilege	3544	wmic.exe
Token: SeRestorePrivilege	3544	wmic.exe
Token: SeShutdownPrivilege	3544	wmic.exe
Token: SeDebugPrivilege	3544	wmic.exe
Token: SeSystemEnvironmentPrivilege	3544	wmic.exe
Token: SeRemoteShutdownPrivilege	3544	wmic.exe
Token: SeUndockPrivilege	3544	wmic.exe
Token: SeManageVolumePrivilege	3544	wmic.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

Avaddon Ransomware.exe

description	pid	process	target process
PID 500 wrote to memory of 3932	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3932	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3932	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 2512	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 2512	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 2512	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 3020	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3020	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3020	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 944	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 944	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 944	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 3544	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3544	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 3544	500	Avaddon Ransomware.exe	wmic.exe
PID 500 wrote to memory of 2068	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 2068	500	Avaddon Ransomware.exe	vssadmin.exe
PID 500 wrote to memory of 2068	500	Avaddon Ransomware.exe	vssadmin.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Avaddon Ransomware.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Avaddon Ransomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Avaddon Ransomware.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	Avaddon Ransomware.exe

C:\Users\Admin\AppData\Local\Temp\Avaddon Ransomware.exe
"C:\Users\Admin\AppData\Local\Temp\Avaddon Ransomware.exe"
1⤵
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:500
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2512
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:944
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1080