General
-
Target
240908-rntphssgre_pw_infected.zip
-
Size
371KB
-
Sample
240909-tyy34ayalr
-
MD5
fa74601145686e95083492e244eeeb77
-
SHA1
9de7c348b8bfc11ba8f28ff11f19172f3024987d
-
SHA256
e76ac2944fb3f66037bc7dd7e83f63bc58099ff2fe31658085c1fdf3d99e3f87
-
SHA512
88c5daf1a48fef42c86756743830f3528068a0a707acc735a8b6949a884110f3fbda38501d0df717e640137f9cb22d50ac3b7006180b59342380f398e20ab2b7
-
SSDEEP
6144:nQKaNUzDAKK186Wyi/A8FLV5N2PAzR7+bm5LeGfcYtUah13hKF7X5lsCo8d4lGZq:QFy8KK1cyWAeJ5nZ+K7fp3mrN7qleq
Static task
static1
Behavioral task
behavioral1
Sample
AvosLocker.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AvosLocker.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
AvosLocker.exe
-
Size
807KB
-
MD5
8da384b2427b8397a5934182c159c257
-
SHA1
7bcd2d32a19c1ac7bd014dc9e64b806fdff5f5de
-
SHA256
f8e99bbacc62b0f72aa12f5f92e35607fa0382a881fe4a4b9476fc6b87a03c78
-
SHA512
3c4b1736efa48a4897769f12df488e60737523eaffc886ecfbd5b7191f058749bdb4a36feb067e8ca0ef418a7602b3390b6cf465412b88a4ba2fce8a4d670a89
-
SSDEEP
12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAu:u4s+oT+NXBLi0rjFXvyHBlb6CZa8
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (10420) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1