General
-
Target
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac
-
Size
775KB
-
Sample
240315-qypb4shf8w
-
MD5
21de830008ad31c83a09be67a3ae8b4d
-
SHA1
c95ac053d6f4284e41dfea342bb30aede7b02244
-
SHA256
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac
-
SHA512
293dc967be7fd187116623cbc67d33b785c7e6d946b22e8793a7432a4eb044ab5f56af12d41c342d2ee06c6350b1615e6b15f9db170518abaad4dd219287d1b1
-
SSDEEP
24576:+Csr9+OXLpMePfI8TgmBTCDqEbOpPtpFadxfq:Y0OXLpMePfzVTCD7gPtLaffq
Behavioral task
behavioral1
Sample
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Users\Admin\Desktop\eM9UR_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Favorites\Microsoft Websites\eM9UR_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Desktop\eM9UR_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Documents\eM9UR_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Targets
-
-
Target
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac
-
Size
775KB
-
MD5
21de830008ad31c83a09be67a3ae8b4d
-
SHA1
c95ac053d6f4284e41dfea342bb30aede7b02244
-
SHA256
bc5c264c4dc0207f6d500c47f870cc2aef641c4bf0efa3b1a408b83922cc61ac
-
SHA512
293dc967be7fd187116623cbc67d33b785c7e6d946b22e8793a7432a4eb044ab5f56af12d41c342d2ee06c6350b1615e6b15f9db170518abaad4dd219287d1b1
-
SSDEEP
24576:+Csr9+OXLpMePfI8TgmBTCDqEbOpPtpFadxfq:Y0OXLpMePfzVTCD7gPtLaffq
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (170) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2