Analysis Overview
SHA256
df480deb191b335dcbc3d4fc5d59594cb38caee2aaef8d877fbbc573de741301
Threat Level: Known bad
The file 6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.7z was found to be: Known bad.
Malicious Activity Summary
Avoslocker Ransomware
Modifies extensions of user files
Drops file in Windows directory
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Checks SCSI registry key(s)
Opens file in notepad (likely ransom note)
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-01-23 13:55
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-01-23 13:55
Reported
2022-01-23 13:56
Platform
win10-en-20211208
Max time kernel
83s
Max time network
72s
Command Line
Signatures
Avoslocker Ransomware
Modifies extensions of user files
| Description | Indicator | Process | Target |
| File renamed | C:\Users\Admin\Pictures\ImportRevoke.tif => C:\Users\Admin\Pictures\ImportRevoke.tif.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\ResetOptimize.tiff | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\StartInstall.tif => C:\Users\Admin\Pictures\StartInstall.tif.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\OpenRedo.tiff => C:\Users\Admin\Pictures\OpenRedo.tiff.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\WriteRename.crw => C:\Users\Admin\Pictures\WriteRename.crw.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\HideRename.raw => C:\Users\Admin\Pictures\HideRename.raw.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\RegisterConfirm.tiff | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\RegisterConfirm.tiff => C:\Users\Admin\Pictures\RegisterConfirm.tiff.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File renamed | C:\Users\Admin\Pictures\ResetOptimize.tiff => C:\Users\Admin\Pictures\ResetOptimize.tiff.avos2 | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
| File opened for modification | C:\Users\Admin\Pictures\OpenRedo.tiff | C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rescache\_merged\4183903823\97717462.pri | C:\Windows\system32\taskmgr.exe | N/A |
| File created | C:\Windows\rescache\_merged\1601268389\1361672858.pri | C:\Windows\system32\taskmgr.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Processes
C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
"C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe"
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt
Network
Files
C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt
| MD5 | 651c844ad8ffea0473fc70cc13ff2e47 |
| SHA1 | f904db3a0e77df893d39cb41fe4297589db82459 |
| SHA256 | f55ec710e56442344196f3612207118d89f877a79a6f8028db520631ace0fa0b |
| SHA512 | 91ca8247d673d8381ca5edc394e86956844218ae291e20480817a5a93ae6e4573af419e3d571815030a375de16e85fd5ec7693331aa6753fe07b88e15701fcae |