avoslocker | df480deb191b335dcbc3d4fc5d59594cb38caee2aaef8d877fbbc573de741301

General

Target

6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
Size

919KB
MD5

40f2238875fcbd2a92cfefc4846a15a8
SHA1

06dce6a5df6ee0099602863a47e2cdeea4e34764
SHA256

6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2
SHA512

8ab1a2124a67e91a4e1842b5f600f977d3d72d398b64ee690c297a04b733e60e01fe4383a1fdf25bb412bc1294d69c5402bd60159c3125bdfb709d024c8e04b8

Score

10^/10

avoslocker ransomware

Malware Config

Extracted

Path

C:\GET_YOUR_FILES_BACK.txt

Family

avoslocker

Ransom Note

Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Your ID: 08604a3c44a32c3c2a51182916c1de99605478319605c31f1215e6109c01f9db

URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion

http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\LimitConvert.crw => C:\Users\Admin\Pictures\LimitConvert.crw.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromInitialize.raw => C:\Users\Admin\Pictures\ConvertFromInitialize.raw.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File renamed	C:\Users\Admin\Pictures\CompressUnblock.crw => C:\Users\Admin\Pictures\CompressUnblock.crw.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File opened for modification	C:\Users\Admin\Pictures\JoinResolve.tiff	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File renamed	C:\Users\Admin\Pictures\HideSwitch.raw => C:\Users\Admin\Pictures\HideSwitch.raw.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File renamed	C:\Users\Admin\Pictures\JoinResolve.tiff => C:\Users\Admin\Pictures\JoinResolve.tiff.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File opened for modification	C:\Users\Admin\Pictures\MountBlock.tiff	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
File renamed	C:\Users\Admin\Pictures\MountBlock.tiff => C:\Users\Admin\Pictures\MountBlock.tiff.avos2	6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe

Drops file in Windows directory 1 IoCs

Processes:

LogonUI.exe

description ioc process

File created C:\Windows\rescache\_merged\421858948\3551649488.pri LogonUI.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\421858948\3551649488.pri	LogonUI.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

LogonUI.exe

pid process

4288 LogonUI.exe
4288 LogonUI.exe

pid	process
4288	LogonUI.exe
4288	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe
"C:\Users\Admin\AppData\Local\Temp\6cc510a772d7718c95216eb56a84a96201241b264755f28875e685f06e95e1a2.exe"
1⤵
- Modifies extensions of user files
PID:3608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad5055 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4288

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads