Analysis Overview
SHA256
c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02
Threat Level: Known bad
The file c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin was found to be: Known bad.
Malicious Activity Summary
Avoslocker Ransomware
Modifies extensions of user files
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2021-12-24 17:52
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2021-12-24 17:52
Reported
2021-12-24 17:54
Platform
win7-en-20211208
Max time kernel
119s
Max time network
119s
Command Line
Signatures
Avoslocker Ransomware
Modifies extensions of user files
Processes
C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe
"C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2021-12-24 17:52
Reported
2021-12-24 17:54
Platform
win10-en-20211208
Max time kernel
117s
Max time network
141s
Command Line
Signatures
Avoslocker Ransomware
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\SearchMeasure.raw => C:\Users\Admin\Pictures\SearchMeasure.raw.avos2 | C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\MoveSuspend.raw => C:\Users\Admin\Pictures\MoveSuspend.raw.avos2 | C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\ConnectExit.tiff | C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ConnectExit.tiff => C:\Users\Admin\Pictures\ConnectExit.tiff.avos2 | C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\SubmitExpand.raw => C:\Users\Admin\Pictures\SubmitExpand.raw.avos2 | C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe
"C:\Users\Admin\AppData\Local\Temp\c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02.bin.exe"
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.21:443 | tcp | |
| US | 8.8.8.8:53 | time.windows.com | udp |
| NL | 40.119.148.38:123 | time.windows.com | udp |