Resubmissions
28-07-2024 16:38
240728-t5tryssgmm 1007-07-2024 14:07
240707-rfgd8atekm 1007-07-2024 14:07
240707-re689awdpe 1013-09-2022 17:54
220913-wg1lpsgbg7 10Analysis
-
max time kernel
65s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
28-07-2024 16:38
General
-
Target
RansomwareSamples/Avaddon_09_06_2020_1054KB.exe
-
Size
1.0MB
-
MD5
c9ec0d9ff44f445ce5614cc87398b38d
-
SHA1
591ffe54bac2c50af61737a28749ff8435168182
-
SHA256
05af0cf40590aef24b28fa04c6b4998b7ab3b7f26e60c507adb84f3d837778f2
-
SHA512
c340baeb66fc46830b6b77b2583033ade6e10b3de04d82ece7e241107afe741442585bf2ea9d6496af93143c37e9676d4f1e1d301d55632b88b12daadadd43f0
-
SSDEEP
24576:Cs6JmdFn5KLOCgHWcAvcrOcEsKfR9uA7rmFbbbbpccf:Cs6JY5KLOCyWcDUfRAA3mFbbbbpc4
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\807042-readme.html
avaddon
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
UAC bypass 3 TTPs 2 IoCs
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Avaddon_09_06_2020_1054KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Avaddon_09_06_2020_1054KB.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\807042-readme.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD598e2e4139c51b21f2228cbb43c221b2c
SHA1b9fe91fc2f73f81e154107f02cff0903b707cb64
SHA256cf754857b5dd3f1caa66b68821b16f3a436cca0981c700463784894deaa053cd
SHA512c42e3843f028c0957f3fa1cf4bdd78bafdaa4d1c641105fa682e71e9d6057390eee7e9ba60abf30185ef90bd08c063c9121def3009f9f256ed3c52dc47e0a02b
-
Filesize
342B
MD5b7675668d8cc7cb961ad097eab8c054d
SHA166936d5eac55700c483c849a885e11d4925bd175
SHA25603a7d50b09c391373f86d3698b0b73b1d12c7056a9de385f12e0c83370b40408
SHA512cb40b17e8720e9ab38a3d8e6868bcba67608e6c98cc9ea6bd1c47f7b4a4944775d2d97c3324870102a23d8f39070d1b27c00f4b6d9302bce0169ee7b867c9353
-
Filesize
342B
MD5be1654c1d1e2fcaacb4a8978dc48cc41
SHA1dfe7dafd455489b47955864c1284220427800eca
SHA256c57c11f95a9b7b316624c116767657b3ccb0fb6ea99abc3acdccfa852c111be0
SHA512d5a3265509f4f8fb4d5e7e7e616ec946af34c97e8968ab732f07b73a96c9cf03c1bae6fd7095beda760c8963021804116cf20cd9571f482bd2572db6e7c5660a
-
Filesize
342B
MD5002686ec7528467a531b0f301925dd83
SHA1885085cd91a552c0cda429ce9105e7ded7c69e52
SHA2569b7e60e3c4f380d27593b02a2462244bf1b8d8450e8584d1ded9f2c95085c7c1
SHA512e4bb3bae9d192e8517a305c3bf1c0143347452767db3e5d2f6f2f0742ba89c0e3e9b1fb59d718a2554ae0b9f05d182adbf037e30b12875ce02f136260c024924
-
Filesize
342B
MD5c85db28461602e72858c1a04fc8eedc4
SHA11539b3c710117c339c97b75b0fd3f29fc14e15ac
SHA256c580f5e9bfc3974ce19b217773b57bf6eefe3ef6cffec5a45d7ebd160ce3091d
SHA512106cb799fef4bee2a2f02ec887a9350141150af961d9173f4ad52db4730152ecabdd353fedb21d64943199c197f77d95a0016c236160516820ecc5684e4a6533
-
Filesize
342B
MD5d5e5003600d54e751c6c390465e36f64
SHA192cda901a0491a58b700d5b8ea8b2df0dec32e5a
SHA256819313fc1bba79774fb586cfc70bba59e4f4e3865eb552b2c08054a6edba2a21
SHA5121a4aee1fc865b113cf5e32986bd6367a870909b6c89a9fb88ac2d1dbc697c9f4ed56d289f01e730fcbe68f42ccae4341d21c4b114c5a169517f35d2c0aed18d4
-
Filesize
342B
MD5ac44cf6b385e1e9aa8e083b369f576f8
SHA15f0648b952ad5595ef34c3fc2c88ac5e446ece25
SHA256912b6bcfe1f40adeb982f7e3601ad711404b5aff68db17104d4dd70bf1628fd4
SHA512c081019b0617212bc8204ebd17cade5958d638f546016a289b4b3cb48b3b220ee8675d7f74091cf119e07c206cd8b20b9403f317ff4a638eb19176c9e7cca966
-
Filesize
342B
MD5a20cb81bfe77a9e08d37563d856edfaa
SHA182d09b3c3fb304089f0bd859b5bb620b48402878
SHA256668815330e3162fc6b13968cdb3c1794ed824ef665beb380d5a6014edb42fcc3
SHA512a7e7f36dd97735ecfb28a56bb1cc7b036796d887dfbbb901ffe76a7b6821757432ddb12cb60fcf56b861f2e84a5e86db1609dba4140e46b5f5d1cc07e021b022
-
Filesize
342B
MD58affc3a4e2241ed9617474f7b8b4742c
SHA1775657cdae4f5bb0102426e170e30d97265120ec
SHA256cc065beb3c39c6603280c5b20605e241ccbf02dd173fd9dc45fdc8d27c4bba03
SHA5120976ecd1aea92211218b11a2bdafd428d2069d9ee13fd48d3756148c9b69e8bac77c227930d917afaf35d2d65aba9556551bdc2cb4dd8360a415012e0629b81a
-
Filesize
342B
MD549e4de2872781beb89a71b97cfb89b0a
SHA123fb6eda0b03944a66b9a434b4c21a734b69f48a
SHA256080e5ede20dbe394700b81e4378034563cb005dd46ceba28be7df11a7e14d6d8
SHA51215dbcd3de617fae3e0cdf2961eb3f772a348cd80ad24257609922822f544e98f4d15dae5f6a337ba87d45cbfa1456547b99e95a46e560d185b050b4e8f2d99e9
-
Filesize
342B
MD5aad614f4d23aca9d0ef32d672dda01b0
SHA1c8463432e583cf62fa4f511b486395b7a3ac8fc1
SHA2562b93e4bf6411d5e13d5b940b4f3c16c540b044f1d1380be501d0a3431c847222
SHA512d7723d9437a88a0279f01c91229c3f33353a62cca66005e1a7e4e6eb7181459a9e8e9731b160fcc4054d28f0d2e73089bacb85f65b7826fb6b725a42770cbfe9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16KB
MD56fe8d49e579c32a03bcc6535b065eeb1
SHA1eb38735106c74009f1d1eae03e2be409b4cba856
SHA25659cfbc2fb8d62a8e5f5fe926d47919c5e0d749618511d3daa69fd0d404179b38
SHA5126d4271ea83cf79d212216b6e6877fae626fdc0cf26a5efd2166a83547deedc87bde904063a361ab411ff835fe226641003a24c99d1311721ee92c6b599e5a6e5