General
-
Target
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c
-
Size
775KB
-
Sample
240315-qxfzcabg98
-
MD5
b9bdbb8cee764b553728f9663617eb11
-
SHA1
4d8d7fce7f5712edd7937607fc471e1de0913493
-
SHA256
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c
-
SHA512
ce6f96612952f350cf7e0d088d25420a03da887f8f89a55903f1ae54d6a8d389c408b885987d80984a316718938efcdea29bb187302025c39aa4edeeff83fceb
-
SSDEEP
24576:TCsh9+OXLpMePfI8TgmBTCDqEbOpPtpFh7xfq:5aOXLpMePfzVTCD7gPtLhdfq
Behavioral task
behavioral1
Sample
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Desktop\VklxuW_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Pictures\VklxuW_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Desktop\LsMJE_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Music\LsMJE_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Targets
-
-
Target
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c
-
Size
775KB
-
MD5
b9bdbb8cee764b553728f9663617eb11
-
SHA1
4d8d7fce7f5712edd7937607fc471e1de0913493
-
SHA256
accdf7be34e793269c8e340d73a34199a9a4b3503e9b2120e9f3ef250f18922c
-
SHA512
ce6f96612952f350cf7e0d088d25420a03da887f8f89a55903f1ae54d6a8d389c408b885987d80984a316718938efcdea29bb187302025c39aa4edeeff83fceb
-
SSDEEP
24576:TCsh9+OXLpMePfI8TgmBTCDqEbOpPtpFh7xfq:5aOXLpMePfzVTCD7gPtLhdfq
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2