Analysis Overview
SHA256
6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2
Threat Level: Known bad
The file 6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin was found to be: Known bad.
Malicious Activity Summary
Avoslocker Ransomware
Modifies extensions of user files
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2021-12-24 17:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-12-24 17:51
Reported
2021-12-24 17:53
Platform
win7-en-20211208
Max time kernel
120s
Max time network
123s
Command Line
Signatures
Avoslocker Ransomware
Modifies extensions of user files
Processes
C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2021-12-24 17:51
Reported
2021-12-24 17:53
Platform
win10-en-20211208
Max time kernel
122s
Max time network
125s
Command Line
Signatures
Avoslocker Ransomware
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\FormatAdd.png => C:\Users\Admin\Pictures\FormatAdd.png.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\SyncConfirm.tiff | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\SyncConfirm.tiff => C:\Users\Admin\Pictures\SyncConfirm.tiff.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe
"C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.bin.exe"
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.21:443 | tcp | |
| US | 8.8.8.8:53 | time.windows.com | udp |
| NL | 20.101.57.9:123 | time.windows.com | udp |