avoslocker | fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb | Triage

Sharing

General

Target

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
Size

1002KB
Sample

240530-d7cnfsea83
MD5

29a6c44066af8bc35809cd1f8976b4d1
SHA1

b963ab9dadb49efe06b1ddddc1bee6e617d8f3e2
SHA256

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
SHA512

33e8027a78612ffe88e99b5281f4c2506727c1829dca4f7168d3dd915adf9e4985ded41f4f68cbc05f599d82e1ff44d0a2ba917bb0ed3873acd047bb96dc9627
SSDEEP

24576:UgoMwIykL7QZON73jGEItU5D7aaBWiP/3VUl:wMTfQUFTTItU5DeWP/3VUl

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Targets

- Target
  
  fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
- Size
  
  1002KB
- MD5
  
  29a6c44066af8bc35809cd1f8976b4d1
- SHA1
  
  b963ab9dadb49efe06b1ddddc1bee6e617d8f3e2
- SHA256
  
  fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
- SHA512
  
  33e8027a78612ffe88e99b5281f4c2506727c1829dca4f7168d3dd915adf9e4985ded41f4f68cbc05f599d82e1ff44d0a2ba917bb0ed3873acd047bb96dc9627
- SSDEEP
  
  24576:UgoMwIykL7QZON73jGEItU5D7aaBWiP/3VUl:wMTfQUFTTItU5DeWP/3VUl
Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10433) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasionevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasionevasionexecutionimpactransomware