General
-
Target
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c
-
Size
775KB
-
Sample
240315-qmjx9abd57
-
MD5
51cd6a0696b29f0a62803561639e8a3c
-
SHA1
e4234a14835cd01fbf12e34bad03d55378ce92ee
-
SHA256
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c
-
SHA512
ec10c9910f944b16e109321f88b0dd6d911b904dd217f4da688adf7ee486e07f5aa3472dd36d951d0ad3816658523e24b06f72afc402776d2d601a7ea2617152
-
SSDEEP
24576:TCs99+OXLpMePfI8TgmBTCDqEbOpPtpFh3xfq:5GOXLpMePfzVTCD7gPtLhhfq
Behavioral task
behavioral1
Sample
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Contacts\tMecQtw_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Documents\tMecQtw_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Documents\2bmmu_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Searches\2bmmu_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Targets
-
-
Target
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c
-
Size
775KB
-
MD5
51cd6a0696b29f0a62803561639e8a3c
-
SHA1
e4234a14835cd01fbf12e34bad03d55378ce92ee
-
SHA256
238a008d432b20076b075ba8ad25412a39f7c44540a59913e5d36a4c23d6c21c
-
SHA512
ec10c9910f944b16e109321f88b0dd6d911b904dd217f4da688adf7ee486e07f5aa3472dd36d951d0ad3816658523e24b06f72afc402776d2d601a7ea2617152
-
SSDEEP
24576:TCs99+OXLpMePfI8TgmBTCDqEbOpPtpFh3xfq:5GOXLpMePfzVTCD7gPtLhhfq
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2