Analysis

  • max time kernel
    165s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 10:08

General

  • Target

    48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.exe

  • Size

    645KB

  • MD5

    79cdf459683c39e9704a37a6be9bc877

  • SHA1

    450d4f351c3dd168e313b309da4bd8a817453d1d

  • SHA256

    48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c

  • SHA512

    2cc3f164e92650c4d4aed7012da7d303d24cdc63565ed744a28cb6d59465189233a128a01f4b807aa972057e0d0d98742c5ca9b41a67bf59f0f115de30eb6bd4

  • SSDEEP

    12288:Ya8gND5n7gG2WERaCyDVbdlSQLeYBgdAULx9mutZo5B:YgNDBg3JRaCyDVplSUBgrHtZor

Malware Config

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

  • Avaddon payload 5 IoCs
  • UAC bypass 3 TTPs 2 IoCs
  • Renames multiple (136) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.exe
    "C:\Users\Admin\AppData\Local\Temp\48689c986eb553e6a7aeba973501b9660cb1418d4ec3ba9d0511f82799d1422c.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4148
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5892
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1108
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 792
      2⤵
      • Program crash
      PID:3924
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 820
      2⤵
      • Program crash
      PID:4480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 828
      2⤵
      • Program crash
      PID:4972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 860
      2⤵
      • Program crash
      PID:5448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 900
      2⤵
      • Program crash
      PID:1644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 960
      2⤵
      • Program crash
      PID:4120
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4680
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4148 -ip 4148
      1⤵
        PID:3752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4148 -ip 4148
        1⤵
          PID:1732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4148 -ip 4148
          1⤵
            PID:4700
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4148 -ip 4148
            1⤵
              PID:4372
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4148 -ip 4148
              1⤵
                PID:5404
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4148 -ip 4148
                1⤵
                  PID:5772

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Impair Defenses

                1
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Modify Registry

                2
                T1112

                Discovery

                System Information Discovery

                3
                T1082

                Query Registry

                1
                T1012

                Peripheral Device Discovery

                1
                T1120

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/4148-1-0x0000000003350000-0x0000000003450000-memory.dmp
                  Filesize

                  1024KB

                • memory/4148-2-0x0000000003790000-0x00000000038A7000-memory.dmp
                  Filesize

                  1.1MB

                • memory/4148-3-0x0000000000400000-0x000000000330D000-memory.dmp
                  Filesize

                  47.1MB

                • memory/4148-4-0x0000000000400000-0x000000000330D000-memory.dmp
                  Filesize

                  47.1MB

                • memory/4148-7-0x0000000003350000-0x0000000003450000-memory.dmp
                  Filesize

                  1024KB

                • memory/4148-8-0x0000000003790000-0x00000000038A7000-memory.dmp
                  Filesize

                  1.1MB

                • memory/4148-107-0x0000000000400000-0x000000000330D000-memory.dmp
                  Filesize

                  47.1MB