Analysis

  • max time kernel
    127s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 10:08

General

  • Target

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe

  • Size

    483KB

  • MD5

    53717dc73f61b0f9551cb62d6fca2e4a

  • SHA1

    1ca9304e86632b147852767c85c57e08bdfc8855

  • SHA256

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028

  • SHA512

    ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552

  • SSDEEP

    12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\KyRgi_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDAEDABBAd You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS0zSEVuSlBpY2FaMm10SWdCNUkxdS9lQ0JDbnB4UzV6YThZNVg0YXZaRjNGTkM4LzhjOE1nR1BxZ0RGUW5pTk5qd0xLM08vaGZxekF6V1M0LzVuTDFORmhPc3hsdEJWQXJKeExydDdIdGlFcXRhNlhXckxYd09LQ25lWjZ4eG1LSXBJRHAvL3Mvei80azduWXJpUXBhN0NpNkhROGdKeXMvQnAyR3VKMnhhdTFXWjM1dFBaeFB2Wkc4TWdpWUxlOWZqZEpHdU1mdmo2bUJGUVJweUQ5ZERuWXFhVmpPQ2FOVmIxYVU5L0pjRFhkUEg4MUxBUVpaUXF0N1dQVHkzVUIyUDRCOWdCY1kxU2ZJTStxbE9WbmViZDlDRkJNcm8wK0xqMHMydFFFTzJ3cDBMRFZEMW1nQkJaZzVLdGdrYVhnSElHT3pLN1phUjQ3TjhncEVrU1NEWmduVTVoSHFzdU9ncDBPaXdNUTUwLzV0LzhNaWgvSlZxejdtVkZYWEp0bFNuODFqMkxaVkVHWUc2SFdyMnRvc3FJSGNuWFZWRXpUVmFTT1VsaSs4cjhTWVZtc2RyMWhTZXBDVHRyMGJxeERZa2xnQUtReDVWcnRYQkR4dFhHd0RNV3JBQnVHNEFrdzZLU2JoamJSOTlRL1BHTDlhM1YrdStEK1Vod1QraUhUdWpIVFlMNndoSkFyWlZDN2E5UHJsbC9TbGZ2ZDVaNStQQUt3M3JnSnR4bmR2bTJ3Mm1VMkpBcit3MDZJWjRPUWdFMnl2NENySUQrRlBIUnZPaHRrazduU1praU1GcUtYdG1vRVA3WVd4ajFveW53THRwNEhadUgvcTR1bWw2U3haQVpGSHpLRld3N1FSY0dYUmxJUCttV09OOUs2Q3gwVm1kTDNjKzhwRFdKek1wNkRxdHlmODlxN2FxeEVSTVVwOVJZUUFKbnFKU0VSSXFFWlNBT1NFWTd3TmlXUFd0RVlDOXppKzBOeG1YV1lhdjdhdjdIVTVhMThYaDZzZjVkUzB2aGVPeS9Fc04wOWM2b2lCY1VEU1dQOXFraTdiT3RYckZkZEpqQU1SWWRrQlJYb0hMY3YxdXc4QWdncmkyZ3gwME4rYnpTK3BtYzE4YXNQbkx5VWVNNmtoYldzTzNUajRrWDVNemZhaFZvNUUwTnVNN1VCNllQbzlLN3BEcEcwOHRPWVV4U0g5bE9mK0dJcUd1ZzRuM21sbkVVYVFZOWZaUEJoVmZEWkJTS3F1K016UG9KNm5jOUlLYzNadnV5QUcrU29Wa1ZHMEF5WDhMbHhyYnFnMXp1TnlUck9jMStvQ1ovNm04MXRWUS9aZXJVWnhXdS9ERjNtR2FyZDBCTENZRHpPNW5lVjMwb2lOYkIrclBEUnZucEZwWEcwVzdxOVdqaGNaczBEZlpWVDVTWEd2ejE0T1VsTjEvMFd0c3BEejFyTVlMM3ZQMmNpZG9lL1J5OTRKRFhiYjlBSEZwc0pEWDZQYzlrVmVPMzE5SnppWGxaSUg2SndtQUp2QlU5ZzdpMXg4UXNsWW5HM3Y0ekRWV2N5VzZuSzBpQ2d6RzEyQXNaZ01LdDVLTWlmaFRrZEt6NFNIeFVzK1VGZDJLSzQwN1lKRmFSZWh2ZFdRQWFBVVFOVUdmaGNyME4vcG9IK2hiMnIzSmFSNnpPZnBlKzAvZXBGZXNhcnc1bXBsdk0zZ211OVZpd0FpVWRPRFA0RXVML2ZzTTFtUDlKSEVQS2dvS2VlbkJnRm45aTZNYXBYMDNiWUVlM0cvYWd3UW9NUXIwcjcyblphb1NXcDdSSmlWY09OR1FMcUZ3M1RZNVdJVjAwUTNVU0Y3YzR6L2Fnd0xvc2FkUUZpOS9FU1M2UnVrTUlYWXY2eEd1ZlVIY2NRcUVieDIrNFlOWTQyNnpWRjNoekdDNTYwMGV2eU5kMnVIc1pqNjhCN2pKME5MVTJUMTMzeWpFMmErUnJEeVhMa0ZjbXBBM3FkVmc0Q2djMDl0QW9YeGdRMXFvdENqZHdQK2c0WURtc204eWNLYm5CSnM5THlaZHg4SU1SOHFOdHF5QUVMK2owOVpJVWxyY0FHUExONkEyQzVIM0lDc2JxVVRwZ1FybGM1TGc2ZmIzWW9oZWJQLytMTlBpb2tKeXhXbWdNdnVYUT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * AaZW3UcKuUe
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Searches\KyRgi_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDAEDABBAd You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS0zSEVuSlBpY2FaMm10SWdCNUkxdS9lQ0JDbnB4UzV6YThZNVg0YXZaRjNGTkM4LzhjOE1nR1BxZ0RGUW5pTk5qd0xLM08vaGZxekF6V1M0LzVuTDFORmhPc3hsdEJWQXJKeExydDdIdGlFcXRhNlhXckxYd09LQ25lWjZ4eG1LSXBJRHAvL3Mvei80azduWXJpUXBhN0NpNkhROGdKeXMvQnAyR3VKMnhhdTFXWjM1dFBaeFB2Wkc4TWdpWUxlOWZqZEpHdU1mdmo2bUJGUVJweUQ5ZERuWXFhVmpPQ2FOVmIxYVU5L0pjRFhkUEg4MUxBUVpaUXF0N1dQVHkzVUIyUDRCOWdCY1kxU2ZJTStxbE9WbmViZDlDRkJNcm8wK0xqMHMydFFFTzJ3cDBMRFZEMW1nQkJaZzVLdGdrYVhnSElHT3pLN1phUjQ3TjhncEVrU1NEWmduVTVoSHFzdU9ncDBPaXdNUTUwLzV0LzhNaWgvSlZxejdtVkZYWEp0bFNuODFqMkxaVkVHWUc2SFdyMnRvc3FJSGNuWFZWRXpUVmFTT1VsaSs4cjhTWVZtc2RyMWhTZXBDVHRyMGJxeERZa2xnQUtReDVWcnRYQkR4dFhHd0RNV3JBQnVHNEFrdzZLU2JoamJSOTlRL1BHTDlhM1YrdStEK1Vod1QraUhUdWpIVFlMNndoSkFyWlZDN2E5UHJsbC9TbGZ2ZDVaNStQQUt3M3JnSnR4bmR2bTJ3Mm1VMkpBcit3MDZJWjRPUWdFMnl2NENySUQrRlBIUnZPaHRrazduU1praU1GcUtYdG1vRVA3WVd4ajFveW53THRwNEhadUgvcTR1bWw2U3haQVpGSHpLRld3N1FSY0dYUmxJUCttV09OOUs2Q3gwVm1kTDNjKzhwRFdKek1wNkRxdHlmODlxN2FxeEVSTVVwOVJZUUFKbnFKU0VSSXFFWlNBT1NFWTd3TmlXUFd0RVlDOXppKzBOeG1YV1lhdjdhdjdIVTVhMThYaDZzZjVkUzB2aGVPeS9Fc04wOWM2b2lCY1VEU1dQOXFraTdiT3RYckZkZEpqQU1SWWRrQlJYb0hMY3YxdXc4QWdncmkyZ3gwME4rYnpTK3BtYzE4YXNQbkx5VWVNNmtoYldzTzNUajRrWDVNemZhaFZvNUUwTnVNN1VCNllQbzlLN3BEcEcwOHRPWVV4U0g5bE9mK0dJcUd1ZzRuM21sbkVVYVFZOWZaUEJoVmZEWkJTS3F1K016UG9KNm5jOUlLYzNadnV5QUcrU29Wa1ZHMEF5WDhMbHhyYnFnMXp1TnlUck9jMStvQ1ovNm04MXRWUS9aZXJVWnhXdS9ERjNtR2FyZDBCTENZRHpPNW5lVjMwb2lOYkIrclBEUnZucEZwWEcwVzdxOVdqaGNaczBEZlpWVDVTWEd2ejE0T1VsTjEvMFd0c3BEejFyTVlMM3ZQMmNpZG9lL1J5OTRKRFhiYjlBSEZwc0pEWDZQYzlrVmVPMzE5SnppWGxaSUg2SndtQUp2QlU5ZzdpMXg4UXNsWW5HM3Y0ekRWV2N5VzZuSzBpQ2d6RzEyQXNaZ01LdDVLTWlmaFRrZEt6NFNIeFVzK1VGZDJLSzQwN1lKRmFSZWh2ZFdRQWFBVVFOVUdmaGNyME4vcG9IK2hiMnIzSmFSNnpPZnBlKzAvZXBGZXNhcnc1bXBsdk0zZ211OVZpd0FpVWRPRFA0RXVML2ZzTTFtUDlKSEVQS2dvS2VlbkJnRm45aTZNYXBYMDNiWUVlM0cvYWd3UW9NUXIwcjcyblphb1NXcDdSSmlWY09OR1FMcUZ3M1RZNVdJVjAwUTNVU0Y3YzR6L2Fnd0xvc2FkUUZpOS9FU1M2UnVrTUlYWXY2eEd1ZlVIY2NRcUVieDIrNFlOWTQyNnpWRjNoekdDNTYwMGV2eU5kMnVIc1pqNjhCN2pKME5MVTJUMTMzeWpFMmErUnJEeVhMa0ZjbXBBM3FkVmc0Q2djMDl0QW9YeGdRMXFvdENqZHdQK2c0WURtc204eWNLYm5CSnM5THlaZHg4SU1SOHFOdHF5QUVMK2owOVpJVWxyY0FHUExONkEyQzVIM0lDc2JxVVRwZ1FybGM1TGc2ZmIzWW9oZWJQLytMTlBpb2tKeXhXbWdNdnVYUT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * WjAtNgP7k6MHD5
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (182) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
    "C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
        PID:4832
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3828

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Defense Evasion

    Indicator Removal

    1
    T1070

    File Deletion

    1
    T1070.004

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\KyRgi_readme_.txt
      Filesize

      3KB

      MD5

      41333c40f73ae203f4a2de488b736962

      SHA1

      282d94836bf7cb43bf31e50458c5395d3c0106d4

      SHA256

      661e46ade6a3e87dadf1a232177f2fe7a9b861d2bbc8507886640712bb5817df

      SHA512

      4daaa1cec24fe32b67543eaca0b1b27068256a464e7137cb6232b79584f735fb48752b307686b32233de1b0241c07c213ea74aaa99d39762a3f643436c55994b

    • C:\Users\Admin\Searches\KyRgi_readme_.txt
      Filesize

      3KB

      MD5

      112fb7e0cf68523b96a35d74a2c52be1

      SHA1

      7729b4433a43fcaa4e5396440df55d899f1cfba9

      SHA256

      fb4a0a7b940600cefaae336deb7ff86220dc0d188c3ae2b960792dec866204e2

      SHA512

      f4fe4118c833e1239a77f8d6a659bcf2122e49dd3c14ca563f550c3853f474cd8195ef8972486b693d1c6dd41344ec05fa3ecdff6891f144d7a5aa78a08cd9e5