Overview

overview

10

Static

static

10

033f4aaa2c...le.exe

windows7_x64

10

033f4aaa2c...le.exe

windows10_x64

10

Resubmissions

16-04-2021 12:52

210416-xmdbnj2h4s 10

16-04-2021 11:48

210416-2lztezmva2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample

  • Size

    1020KB

  • Sample

    210416-xmdbnj2h4s

  • MD5

    c250e298e0a349e8d1faeb5ba6f4a853

  • SHA1

    71b774aa592ba435eb8260d6f16e36b67c51babe

  • SHA256

    033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b

  • SHA512

    700a09e44e9d2fd092904886e882e8deb5a6d17d34be8575df6367ef729627a180ee62ea59df6457d965fccbe27809895ca83e1e3b8b7e888f752173eba1cbe1

Score
10/10
avaddonevasionransomwaretrojan

Malware Config

Targets

    • Target

      033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample

    • Size

      1020KB

    • MD5

      c250e298e0a349e8d1faeb5ba6f4a853

    • SHA1

      71b774aa592ba435eb8260d6f16e36b67c51babe

    • SHA256

      033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b

    • SHA512

      700a09e44e9d2fd092904886e882e8deb5a6d17d34be8575df6367ef729627a180ee62ea59df6457d965fccbe27809895ca83e1e3b8b7e888f752173eba1cbe1

    Score
    10/10
    avaddonevasionransomwaretrojan

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

      ransomwareavaddon

    • Avaddon Ransomware

      ransomware

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

File Deletion

2
T1107

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

5
T1082

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks