Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d841d0a10e...cb.exe

windows7-x64

10

d841d0a10e...cb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    157s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2024, 13:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe

  • Size

    441KB

  • MD5

    b1758767d10c75d1589c16763fca6fd3

  • SHA1

    2722f21a31859ea735e908a1c705d07b139e3b12

  • SHA256

    d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb

  • SHA512

    93bdfaf8a7b35e3c0110e931a35c5a901c8acf06b36dd9e8cba9b770be642525ba0350ae94d68556961b06b0d802cd2e1997fc73849c643f76eba721215abf5e

  • SSDEEP

    12288:5I7bv0KUN/9MISQBqz9xbwL5A++dMncx4wjSvh:K7QzuyErzrSwjMh

Score
10/10
avaddonevasionransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\OAE5M_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .CaEBCdDCEE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1UM2RoVkVzSGIzK1RMeUpNamZRUEhlSm5XSFRCK2haZlcvd2tiaTJzcDBpNHQwdnZaK0ZCS01IV3dvTm1xZ1JIL3NIQmdMSEFrczczS2RwNkp2OXpBVDNSTmFrVVJ4Y1ZwbTRMTzJ2emdTbzMvWWtZcEJsUW0zRE5MWDRuN01LNjVwVmhKVHhCODB5V2xRTHZ3Qm5pMlYzeUlIKy8yZVNyZzN5bWcvNzdqWEk3RE5HM1RDTTFUeW5sUENJTSt3cFNwMG5GNlU5TG1DalBsNFl2QkRpL2R5aFEwNkljSHZoT3N3V1lhK0prTUw0eWpHYVRXaXNVd1Mrak0wdkJCOTFmZmNIa3lVWjBhbGI0ejdUTnZUckhKTmNRZ0Q2U2M5anArbGFSM1llNzNuR0ZrWUV0Sm1DLzA3d1FDOW10ZkNyZmZiN1IrSTRidXc0KzhEYm95eGt6ZHhSZWh3QjYrWWVESDM5ZEJJcnNGQnNpbkRRdk5iMkU3M1NQYkRFOWJFaU5idDRBYXNNcWh3bzVVMnczSndBcG96MVN1M2RJWkxacnVRQWZic1ZGUDcweksybG5JOGNQN25WbmxheTdVOXlYS1BjMXpvVGxDdE5xRzQ0S0J0RWdibEdlK2FBYnNsR0wxbmRURDV0ODh5M2xNSGcyZGZIb1lXcW9VN3NYcHl1RFhITHpZdmIzRktVbUVXbThYMGduOUtmZW9tQmd0ZzJWd3luRmVoUkJpVnZnMDgxWUFsYXorZi8rZWZPc05ZVlJsWjJFeURRcmRseWpaOHhCb0hNSk1MR1g1blFJR3FZK2F3MXZ0ZGtwNitNcXVrWU1JWmdtUnRleWZSUERicUQzbzZyRXAzZTJhU2E3b25zdWNBcXoyc0VLNm5ISGpJTENPR0o3dEpIaDQ5TmllRWJubWI1Y28wRjc2bHB6cGNiL2lSZkJ2S05JQlJ4bHhVOWhxaEVDZkJSWGpPeVMyaXZ1ODZaSGNIUG4yZTg1WVVGOVZIeC9EbmU2RkdtSE9SM0N6MHpqSXhmZEN6azQ3Wm1IZHNaMS9sOGQ3MmRSQjJCTis2QWIyVzJPSTJyTVhaTFpwalExcXpSWUd3L0FhbFZIdlN0aFZURVY2LzRmTThJVENuYkNXSGdrR2Uwb1poWDNteVM3OFRCcmRML0hEdXZKZGVWSUN1RDV6RVBCQnJWYkptd0gzWjI5MmIvMmVUdXk0aDFyR1JWYzNyM0NVRWR1Mit6Z2JCRlRaSnRYZSt5alZhc2djamtiTWtORzR6ZlBaMGovOGFDd21BYTZrMDd4aWIrS2NlVE1GYXM1aldmdG5wSWluNkFpaUEzSjBXZGt3M2UyajhDNzI3V0tnRFJSaFZlU0Z2M0ZxbDZ5Mko1QjZBYWQ3MUYwNFZHSEhKd0JNUjRhMHdqZXEweWhUMSsxMnpQZk4xTG9nQk5rVmN5K0JYVVg4MXhnQ3dlYWp1bmxYOGVhRjJTV0pRWDQrQ0RCa0ZlaU5PbExUTEFCYU5CUHhEbDVmSjdtU3BvOUo5eTVUa0ppazJMbGFyT3JUM2dGclBsK0V0UkpqN3o0ZjdaNFJrVEI4UmNIWFA0dDdFZnpaSTk1R20rRkdOcjZ3K1VLSnA1VFVZR3IzY1JSUllmWXR3S0F5N0lWNFp2dkV0YkVwOGljWm41UUpVbXphTyt4SHFWbUxNZmFtbnpoVGJSTHNONDJMRVdyZXBkL2JLcTJMblNxV21YbjNEVVhOOXNKU3ZZVGJxTFZnbDRYQmdEaktLVkc4cmFRMGs2WjZiRUdmVlNiSlpQUEgzb1JvdEIrdE9YRC8xeGxFbzRvWjhZTlk2OFppTlM1NlFSeXMwbWdDaEdsZ08xa3Z3VFNKVnhiVVNsbVdscHplS1Vib0tkWXBkQ3JKRWg3bnpqNnhKZnRldkJ2YVl4R0NQTDZPQ3dyRGxraFFJbzFhMmhVck5GbFVnbjlKcXh2bjAvc1FVSEtPbENUTzZFdmVkVlRyN25iMThoWmhnVXZ3Y2dUZ0pwMmtiZ3pYcWNVa3VSZCtzY3ZqNVhxaDV3Q0EvV0RNNjR5SXk3UUxteGg4L3VwZlRqZFJqRmRFaGwwTW9SMThPZE9qUnZvSHcrYkdlcWR0WU9ma3JYa055SGFQUlVyRUludzJ0MTZ3UT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * wclDp9nX7wHw
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\OAE5M_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .CaEBCdDCEE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1UM2RoVkVzSGIzK1RMeUpNamZRUEhlSm5XSFRCK2haZlcvd2tiaTJzcDBpNHQwdnZaK0ZCS01IV3dvTm1xZ1JIL3NIQmdMSEFrczczS2RwNkp2OXpBVDNSTmFrVVJ4Y1ZwbTRMTzJ2emdTbzMvWWtZcEJsUW0zRE5MWDRuN01LNjVwVmhKVHhCODB5V2xRTHZ3Qm5pMlYzeUlIKy8yZVNyZzN5bWcvNzdqWEk3RE5HM1RDTTFUeW5sUENJTSt3cFNwMG5GNlU5TG1DalBsNFl2QkRpL2R5aFEwNkljSHZoT3N3V1lhK0prTUw0eWpHYVRXaXNVd1Mrak0wdkJCOTFmZmNIa3lVWjBhbGI0ejdUTnZUckhKTmNRZ0Q2U2M5anArbGFSM1llNzNuR0ZrWUV0Sm1DLzA3d1FDOW10ZkNyZmZiN1IrSTRidXc0KzhEYm95eGt6ZHhSZWh3QjYrWWVESDM5ZEJJcnNGQnNpbkRRdk5iMkU3M1NQYkRFOWJFaU5idDRBYXNNcWh3bzVVMnczSndBcG96MVN1M2RJWkxacnVRQWZic1ZGUDcweksybG5JOGNQN25WbmxheTdVOXlYS1BjMXpvVGxDdE5xRzQ0S0J0RWdibEdlK2FBYnNsR0wxbmRURDV0ODh5M2xNSGcyZGZIb1lXcW9VN3NYcHl1RFhITHpZdmIzRktVbUVXbThYMGduOUtmZW9tQmd0ZzJWd3luRmVoUkJpVnZnMDgxWUFsYXorZi8rZWZPc05ZVlJsWjJFeURRcmRseWpaOHhCb0hNSk1MR1g1blFJR3FZK2F3MXZ0ZGtwNitNcXVrWU1JWmdtUnRleWZSUERicUQzbzZyRXAzZTJhU2E3b25zdWNBcXoyc0VLNm5ISGpJTENPR0o3dEpIaDQ5TmllRWJubWI1Y28wRjc2bHB6cGNiL2lSZkJ2S05JQlJ4bHhVOWhxaEVDZkJSWGpPeVMyaXZ1ODZaSGNIUG4yZTg1WVVGOVZIeC9EbmU2RkdtSE9SM0N6MHpqSXhmZEN6azQ3Wm1IZHNaMS9sOGQ3MmRSQjJCTis2QWIyVzJPSTJyTVhaTFpwalExcXpSWUd3L0FhbFZIdlN0aFZURVY2LzRmTThJVENuYkNXSGdrR2Uwb1poWDNteVM3OFRCcmRML0hEdXZKZGVWSUN1RDV6RVBCQnJWYkptd0gzWjI5MmIvMmVUdXk0aDFyR1JWYzNyM0NVRWR1Mit6Z2JCRlRaSnRYZSt5alZhc2djamtiTWtORzR6ZlBaMGovOGFDd21BYTZrMDd4aWIrS2NlVE1GYXM1aldmdG5wSWluNkFpaUEzSjBXZGt3M2UyajhDNzI3V0tnRFJSaFZlU0Z2M0ZxbDZ5Mko1QjZBYWQ3MUYwNFZHSEhKd0JNUjRhMHdqZXEweWhUMSsxMnpQZk4xTG9nQk5rVmN5K0JYVVg4MXhnQ3dlYWp1bmxYOGVhRjJTV0pRWDQrQ0RCa0ZlaU5PbExUTEFCYU5CUHhEbDVmSjdtU3BvOUo5eTVUa0ppazJMbGFyT3JUM2dGclBsK0V0UkpqN3o0ZjdaNFJrVEI4UmNIWFA0dDdFZnpaSTk1R20rRkdOcjZ3K1VLSnA1VFVZR3IzY1JSUllmWXR3S0F5N0lWNFp2dkV0YkVwOGljWm41UUpVbXphTyt4SHFWbUxNZmFtbnpoVGJSTHNONDJMRVdyZXBkL2JLcTJMblNxV21YbjNEVVhOOXNKU3ZZVGJxTFZnbDRYQmdEaktLVkc4cmFRMGs2WjZiRUdmVlNiSlpQUEgzb1JvdEIrdE9YRC8xeGxFbzRvWjhZTlk2OFppTlM1NlFSeXMwbWdDaEdsZ08xa3Z3VFNKVnhiVVNsbVdscHplS1Vib0tkWXBkQ3JKRWg3bnpqNnhKZnRldkJ2YVl4R0NQTDZPQ3dyRGxraFFJbzFhMmhVck5GbFVnbjlKcXh2bjAvc1FVSEtPbENUTzZFdmVkVlRyN25iMThoWmhnVXZ3Y2dUZ0pwMmtiZ3pYcWNVa3VSZCtzY3ZqNVhxaDV3Q0EvV0RNNjR5SXk3UUxteGg4L3VwZlRqZFJqRmRFaGwwTW9SMThPZE9qUnZvSHcrYkdlcWR0WU9ma3JYa055SGFQUlVyRUludzJ0MTZ3UT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * mktZAMaKTYzVg6Y
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\OAE5M_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .CaEBCdDCEE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1UM2RoVkVzSGIzK1RMeUpNamZRUEhlSm5XSFRCK2haZlcvd2tiaTJzcDBpNHQwdnZaK0ZCS01IV3dvTm1xZ1JIL3NIQmdMSEFrczczS2RwNkp2OXpBVDNSTmFrVVJ4Y1ZwbTRMTzJ2emdTbzMvWWtZcEJsUW0zRE5MWDRuN01LNjVwVmhKVHhCODB5V2xRTHZ3Qm5pMlYzeUlIKy8yZVNyZzN5bWcvNzdqWEk3RE5HM1RDTTFUeW5sUENJTSt3cFNwMG5GNlU5TG1DalBsNFl2QkRpL2R5aFEwNkljSHZoT3N3V1lhK0prTUw0eWpHYVRXaXNVd1Mrak0wdkJCOTFmZmNIa3lVWjBhbGI0ejdUTnZUckhKTmNRZ0Q2U2M5anArbGFSM1llNzNuR0ZrWUV0Sm1DLzA3d1FDOW10ZkNyZmZiN1IrSTRidXc0KzhEYm95eGt6ZHhSZWh3QjYrWWVESDM5ZEJJcnNGQnNpbkRRdk5iMkU3M1NQYkRFOWJFaU5idDRBYXNNcWh3bzVVMnczSndBcG96MVN1M2RJWkxacnVRQWZic1ZGUDcweksybG5JOGNQN25WbmxheTdVOXlYS1BjMXpvVGxDdE5xRzQ0S0J0RWdibEdlK2FBYnNsR0wxbmRURDV0ODh5M2xNSGcyZGZIb1lXcW9VN3NYcHl1RFhITHpZdmIzRktVbUVXbThYMGduOUtmZW9tQmd0ZzJWd3luRmVoUkJpVnZnMDgxWUFsYXorZi8rZWZPc05ZVlJsWjJFeURRcmRseWpaOHhCb0hNSk1MR1g1blFJR3FZK2F3MXZ0ZGtwNitNcXVrWU1JWmdtUnRleWZSUERicUQzbzZyRXAzZTJhU2E3b25zdWNBcXoyc0VLNm5ISGpJTENPR0o3dEpIaDQ5TmllRWJubWI1Y28wRjc2bHB6cGNiL2lSZkJ2S05JQlJ4bHhVOWhxaEVDZkJSWGpPeVMyaXZ1ODZaSGNIUG4yZTg1WVVGOVZIeC9EbmU2RkdtSE9SM0N6MHpqSXhmZEN6azQ3Wm1IZHNaMS9sOGQ3MmRSQjJCTis2QWIyVzJPSTJyTVhaTFpwalExcXpSWUd3L0FhbFZIdlN0aFZURVY2LzRmTThJVENuYkNXSGdrR2Uwb1poWDNteVM3OFRCcmRML0hEdXZKZGVWSUN1RDV6RVBCQnJWYkptd0gzWjI5MmIvMmVUdXk0aDFyR1JWYzNyM0NVRWR1Mit6Z2JCRlRaSnRYZSt5alZhc2djamtiTWtORzR6ZlBaMGovOGFDd21BYTZrMDd4aWIrS2NlVE1GYXM1aldmdG5wSWluNkFpaUEzSjBXZGt3M2UyajhDNzI3V0tnRFJSaFZlU0Z2M0ZxbDZ5Mko1QjZBYWQ3MUYwNFZHSEhKd0JNUjRhMHdqZXEweWhUMSsxMnpQZk4xTG9nQk5rVmN5K0JYVVg4MXhnQ3dlYWp1bmxYOGVhRjJTV0pRWDQrQ0RCa0ZlaU5PbExUTEFCYU5CUHhEbDVmSjdtU3BvOUo5eTVUa0ppazJMbGFyT3JUM2dGclBsK0V0UkpqN3o0ZjdaNFJrVEI4UmNIWFA0dDdFZnpaSTk1R20rRkdOcjZ3K1VLSnA1VFVZR3IzY1JSUllmWXR3S0F5N0lWNFp2dkV0YkVwOGljWm41UUpVbXphTyt4SHFWbUxNZmFtbnpoVGJSTHNONDJMRVdyZXBkL2JLcTJMblNxV21YbjNEVVhOOXNKU3ZZVGJxTFZnbDRYQmdEaktLVkc4cmFRMGs2WjZiRUdmVlNiSlpQUEgzb1JvdEIrdE9YRC8xeGxFbzRvWjhZTlk2OFppTlM1NlFSeXMwbWdDaEdsZ08xa3Z3VFNKVnhiVVNsbVdscHplS1Vib0tkWXBkQ3JKRWg3bnpqNnhKZnRldkJ2YVl4R0NQTDZPQ3dyRGxraFFJbzFhMmhVck5GbFVnbjlKcXh2bjAvc1FVSEtPbENUTzZFdmVkVlRyN25iMThoWmhnVXZ3Y2dUZ0pwMmtiZ3pYcWNVa3VSZCtzY3ZqNVhxaDV3Q0EvV0RNNjR5SXk3UUxteGg4L3VwZlRqZFJqRmRFaGwwTW9SMThPZE9qUnZvSHcrYkdlcWR0WU9ma3JYa055SGFQUlVyRUludzJ0MTZ3UT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 8MUQVYNeIAh422C7Tp1
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\OAE5M_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .CaEBCdDCEE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1UM2RoVkVzSGIzK1RMeUpNamZRUEhlSm5XSFRCK2haZlcvd2tiaTJzcDBpNHQwdnZaK0ZCS01IV3dvTm1xZ1JIL3NIQmdMSEFrczczS2RwNkp2OXpBVDNSTmFrVVJ4Y1ZwbTRMTzJ2emdTbzMvWWtZcEJsUW0zRE5MWDRuN01LNjVwVmhKVHhCODB5V2xRTHZ3Qm5pMlYzeUlIKy8yZVNyZzN5bWcvNzdqWEk3RE5HM1RDTTFUeW5sUENJTSt3cFNwMG5GNlU5TG1DalBsNFl2QkRpL2R5aFEwNkljSHZoT3N3V1lhK0prTUw0eWpHYVRXaXNVd1Mrak0wdkJCOTFmZmNIa3lVWjBhbGI0ejdUTnZUckhKTmNRZ0Q2U2M5anArbGFSM1llNzNuR0ZrWUV0Sm1DLzA3d1FDOW10ZkNyZmZiN1IrSTRidXc0KzhEYm95eGt6ZHhSZWh3QjYrWWVESDM5ZEJJcnNGQnNpbkRRdk5iMkU3M1NQYkRFOWJFaU5idDRBYXNNcWh3bzVVMnczSndBcG96MVN1M2RJWkxacnVRQWZic1ZGUDcweksybG5JOGNQN25WbmxheTdVOXlYS1BjMXpvVGxDdE5xRzQ0S0J0RWdibEdlK2FBYnNsR0wxbmRURDV0ODh5M2xNSGcyZGZIb1lXcW9VN3NYcHl1RFhITHpZdmIzRktVbUVXbThYMGduOUtmZW9tQmd0ZzJWd3luRmVoUkJpVnZnMDgxWUFsYXorZi8rZWZPc05ZVlJsWjJFeURRcmRseWpaOHhCb0hNSk1MR1g1blFJR3FZK2F3MXZ0ZGtwNitNcXVrWU1JWmdtUnRleWZSUERicUQzbzZyRXAzZTJhU2E3b25zdWNBcXoyc0VLNm5ISGpJTENPR0o3dEpIaDQ5TmllRWJubWI1Y28wRjc2bHB6cGNiL2lSZkJ2S05JQlJ4bHhVOWhxaEVDZkJSWGpPeVMyaXZ1ODZaSGNIUG4yZTg1WVVGOVZIeC9EbmU2RkdtSE9SM0N6MHpqSXhmZEN6azQ3Wm1IZHNaMS9sOGQ3MmRSQjJCTis2QWIyVzJPSTJyTVhaTFpwalExcXpSWUd3L0FhbFZIdlN0aFZURVY2LzRmTThJVENuYkNXSGdrR2Uwb1poWDNteVM3OFRCcmRML0hEdXZKZGVWSUN1RDV6RVBCQnJWYkptd0gzWjI5MmIvMmVUdXk0aDFyR1JWYzNyM0NVRWR1Mit6Z2JCRlRaSnRYZSt5alZhc2djamtiTWtORzR6ZlBaMGovOGFDd21BYTZrMDd4aWIrS2NlVE1GYXM1aldmdG5wSWluNkFpaUEzSjBXZGt3M2UyajhDNzI3V0tnRFJSaFZlU0Z2M0ZxbDZ5Mko1QjZBYWQ3MUYwNFZHSEhKd0JNUjRhMHdqZXEweWhUMSsxMnpQZk4xTG9nQk5rVmN5K0JYVVg4MXhnQ3dlYWp1bmxYOGVhRjJTV0pRWDQrQ0RCa0ZlaU5PbExUTEFCYU5CUHhEbDVmSjdtU3BvOUo5eTVUa0ppazJMbGFyT3JUM2dGclBsK0V0UkpqN3o0ZjdaNFJrVEI4UmNIWFA0dDdFZnpaSTk1R20rRkdOcjZ3K1VLSnA1VFVZR3IzY1JSUllmWXR3S0F5N0lWNFp2dkV0YkVwOGljWm41UUpVbXphTyt4SHFWbUxNZmFtbnpoVGJSTHNONDJMRVdyZXBkL2JLcTJMblNxV21YbjNEVVhOOXNKU3ZZVGJxTFZnbDRYQmdEaktLVkc4cmFRMGs2WjZiRUdmVlNiSlpQUEgzb1JvdEIrdE9YRC8xeGxFbzRvWjhZTlk2OFppTlM1NlFSeXMwbWdDaEdsZ08xa3Z3VFNKVnhiVVNsbVdscHplS1Vib0tkWXBkQ3JKRWg3bnpqNnhKZnRldkJ2YVl4R0NQTDZPQ3dyRGxraFFJbzFhMmhVck5GbFVnbjlKcXh2bjAvc1FVSEtPbENUTzZFdmVkVlRyN25iMThoWmhnVXZ3Y2dUZ0pwMmtiZ3pYcWNVa3VSZCtzY3ZqNVhxaDV3Q0EvV0RNNjR5SXk3UUxteGg4L3VwZlRqZFJqRmRFaGwwTW9SMThPZE9qUnZvSHcrYkdlcWR0WU9ma3JYa055SGFQUlVyRUludzJ0MTZ3UT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * L7g9AxSlyO7iHsyhJsqI22JmW
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Avaddon payload 1 IoCs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (146) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe
    "C:\Users\Admin\AppData\Local\Temp\d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5104
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
        PID:4624
      • C:\Windows\SysWOW64\Wbem\wmic.exe
        wmic SHADOWCOPY DELETE /nointeractive
        2⤵
          PID:3380
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic SHADOWCOPY DELETE /nointeractive
          2⤵
            PID:3308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:3672
          • C:\Windows\system32\wbem\wmic.exe
            wmic SHADOWCOPY DELETE /nointeractive
            1⤵
            • Process spawned unexpected child process
            • Suspicious use of AdjustPrivilegeToken
            PID:5000
          • C:\Windows\system32\wbem\wmic.exe
            wmic SHADOWCOPY DELETE /nointeractive
            1⤵
            • Process spawned unexpected child process
            • Suspicious use of AdjustPrivilegeToken
            PID:1868
          • C:\Windows\system32\wbem\wmic.exe
            wmic SHADOWCOPY DELETE /nointeractive
            1⤵
            • Process spawned unexpected child process
            • Suspicious use of AdjustPrivilegeToken
            PID:1844
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
              PID:2100
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe
              1⤵
              • Executes dropped EXE
              PID:1444

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\OAE5M_readme_.txt
              Filesize

              3KB

              MD5

              2ad51921c51d221c966b9196b20d608e

              SHA1

              d1cf0b68bea3c08df46de3683588bb3e9109501c

              SHA256

              bc9aeb7c02ca6088fb8369675eafa81e0781521c49274e90e8cb8d3bb03ca90f

              SHA512

              ea75e026d40f44d2715ae6218d01e6e14daa766d29c7d88c8cbcb1bcdcff97112e36904d1d148aa2f53d2e709009fb1bb4b16a4214f1dbb48f81186414359b2b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb.exe
              Filesize

              441KB

              MD5

              b1758767d10c75d1589c16763fca6fd3

              SHA1

              2722f21a31859ea735e908a1c705d07b139e3b12

              SHA256

              d841d0a10e8b6885f1b8e1282c70e88d4f74471fbbe1b4b6f29b4ca238b1e8cb

              SHA512

              93bdfaf8a7b35e3c0110e931a35c5a901c8acf06b36dd9e8cba9b770be642525ba0350ae94d68556961b06b0d802cd2e1997fc73849c643f76eba721215abf5e

              Download Submit

            • C:\Users\Admin\Desktop\OAE5M_readme_.txt
              Filesize

              3KB

              MD5

              e87bc5feeb09687c9e6974651b995ed1

              SHA1

              6c1f2a0664ec4090e2f1da61b33e06f1559c08b3

              SHA256

              bd243377d2a41e49028e78297e7172aa2dd96ea6174553e7523ce3d839acfe75

              SHA512

              782403f01a4bd4163e8a6222648b192901f5897e628465b48c7e5d8925c573cbebe3ef6d63fa1fb01d71a5a33dce69328038b8d2c7b28fa3691f6dc859b22d1d

              Download Submit

            • C:\Users\Admin\Downloads\OAE5M_readme_.txt
              Filesize

              3KB

              MD5

              3504101c6cc14c4bbc64e112e7a0b3c3

              SHA1

              f55261f8f30a7c9f807be2b01c4684fc01d887fd

              SHA256

              75a4b0eded368e526750720e13cde8c6b63ee431cf8448e7a934c8687c4527e0

              SHA512

              8a46376f4b1ab86a5eb3e74b793b9f772a564d540734375c0984b541e344ed300135441460324d4faa1bdd23bfa89e0919352233b9361c0615e6b33c87609af5

              Download Submit

            • C:\Users\Admin\Pictures\OAE5M_readme_.txt
              Filesize

              3KB

              MD5

              4e25ec3f38564db2b8d4b3e5bdecc029

              SHA1

              2e62894ce39007587f8dd63743ef1199850d0afb

              SHA256

              4cf947c8461055c51d66850320d3fb11381642781eb3c58712b9535aa916a535

              SHA512

              0baffbf1af0bc52e16a168477ed1f01d1a852eb6ebeefda5724a26a8e6537d0248cefd4f40d97fa1f9d9a386d067ee2643dacef792194d3a37a5cf3aef6b19fc

              Download Submit

            • memory/1444-425-0x0000000000400000-0x00000000005E3204-memory.dmp

              Filesize

              1.9MB

              Download

            • memory/5104-0-0x0000000000400000-0x00000000005E3204-memory.dmp

              Filesize

              1.9MB

              Download