Overview

overview

10

Static

static

10

033f4aaa2c...le.exe

windows7_x64

10

033f4aaa2c...le.exe

windows10_x64

10

Resubmissions

16-04-2021 12:52

210416-xmdbnj2h4s 10

16-04-2021 11:48

210416-2lztezmva2 10

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    16-04-2021 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe

  • Size

    1020KB

  • MD5

    c250e298e0a349e8d1faeb5ba6f4a853

  • SHA1

    71b774aa592ba435eb8260d6f16e36b67c51babe

  • SHA256

    033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b

  • SHA512

    700a09e44e9d2fd092904886e882e8deb5a6d17d34be8575df6367ef729627a180ee62ea59df6457d965fccbe27809895ca83e1e3b8b7e888f752173eba1cbe1

Score
10/10
avaddonevasionransomwaretrojan

Malware Config

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Avaddon Ransomware 2 IoCs
    ransomware
  • UAC bypass 3 TTPs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe"
    1⤵
    • Modifies extensions of user files
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:792
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:1672
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:524
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:316
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1568
    • C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2036
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1512
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {A23212A3-7C24-4A7E-A15C-C8AF0F5BE9A4} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:300
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe
      2⤵
      • Executes dropped EXE
      PID:1436
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1668
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x498
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1496

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    1
    T1089

    Modify Registry

    3
    T1112

    File Deletion

    2
    T1107

    Install Root Certificate

    1
    T1130

    Credential Access

    Discovery

    System Information Discovery

    3
    T1082

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe
      MD5

      c250e298e0a349e8d1faeb5ba6f4a853

      SHA1

      71b774aa592ba435eb8260d6f16e36b67c51babe

      SHA256

      033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b

      SHA512

      700a09e44e9d2fd092904886e882e8deb5a6d17d34be8575df6367ef729627a180ee62ea59df6457d965fccbe27809895ca83e1e3b8b7e888f752173eba1cbe1

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b.bin.sample.exe
      MD5

      c250e298e0a349e8d1faeb5ba6f4a853

      SHA1

      71b774aa592ba435eb8260d6f16e36b67c51babe

      SHA256

      033f4aaa2ca181597644ae7d2f883e05c2d9eea669f71117a312cfd591303c4b

      SHA512

      700a09e44e9d2fd092904886e882e8deb5a6d17d34be8575df6367ef729627a180ee62ea59df6457d965fccbe27809895ca83e1e3b8b7e888f752173eba1cbe1

      Download Submit
    • memory/316-63-0x0000000000000000-mapping.dmp
      Download
    • memory/524-62-0x0000000000000000-mapping.dmp
      Download
    • memory/792-59-0x0000000075551000-0x0000000075553000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1064-60-0x0000000000000000-mapping.dmp
      Download
    • memory/1436-67-0x0000000000000000-mapping.dmp
      Download
    • memory/1568-64-0x0000000000000000-mapping.dmp
      Download
    • memory/1668-70-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1672-61-0x0000000000000000-mapping.dmp
      Download
    • memory/2036-65-0x0000000000000000-mapping.dmp
      Download