avoslocker | eba3a5a7171c68752065faeff30716844b53d14bba821bf33002189b64eda115 | Triage

Sharing

General

Target

eba3a5a7171c68752065faeff30716844b53d14bba821bf33002189b64eda115
Size

1002KB
Sample

240531-jgy2nacb99
MD5

97b34aecdcbe69cc57b4d321b0700cd9
SHA1

b2f2a027512a6f2b4ea856468eaccf6250a555d4
SHA256

eba3a5a7171c68752065faeff30716844b53d14bba821bf33002189b64eda115
SHA512

5436ad5e25083f167de6a30d2aa06d4dce514a4b5a2cc6d9ca5a4b1f7d3903f2d0bb70f64fa4562b26857dac7bd36ef7c8bb5b766d4975a0fef39a01dac63327
SSDEEP

24576:Lgg34ayddj+yYCVj2EG1bWIL0oHPVRV37AXVJmUCOsvxFdUwcT:E2edj4CwE4bFbl7AqUgvrFcT

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Targets

- Target
  
  eba3a5a7171c68752065faeff30716844b53d14bba821bf33002189b64eda115
- Size
  
  1002KB
- MD5
  
  97b34aecdcbe69cc57b4d321b0700cd9
- SHA1
  
  b2f2a027512a6f2b4ea856468eaccf6250a555d4
- SHA256
  
  eba3a5a7171c68752065faeff30716844b53d14bba821bf33002189b64eda115
- SHA512
  
  5436ad5e25083f167de6a30d2aa06d4dce514a4b5a2cc6d9ca5a4b1f7d3903f2d0bb70f64fa4562b26857dac7bd36ef7c8bb5b766d4975a0fef39a01dac63327
- SSDEEP
  
  24576:Lgg34ayddj+yYCVj2EG1bWIL0oHPVRV37AXVJmUCOsvxFdUwcT:E2edj4CwE4bFbl7AqUgvrFcT
Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10387) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasionevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasionevasionexecutionimpactransomware