avoslocker | e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0 | Triage

Sharing

General

Target

e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0
Size

260KB
Sample

240724-vpcdeazhpe
MD5

30dd519541017f677e0a6e6ce73a0e72
SHA1

45c0f2e82ef4203713841602bc1171dc041aab1b
SHA256

e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0
SHA512

77c7f2683b7c16fdedf9b8bc05383fe50c3f8ff75180ac8a99165c48c238d276e0724595bf04266ed750c2e0f44ece47e620729273cc44ade8c5bc1b2250aeee
SSDEEP

6144:IxPH9+x9UV8Peqge8z+dYqYoX136lkgJG4H9Gfsj:IK9UVueDe/yoEl7JGaGfsj

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Malware Config

Targets

- Target
  
  BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
- Size
  
  807KB
- MD5
  
  19944159dfa94a1b75effd85e6b906dc
- SHA1
  
  250acf87366f4c0cf91679a0e93dfc79954f0f10
- SHA256
  
  bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
- SHA512
  
  c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
- SSDEEP
  
  12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10395) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware