avoslocker | 7d1e470e36c68e1156a7828f8002254dcde68dc61f998ab5636c12ba63f472dd | Triage

Sharing

General

Target

2024-09-23_9593e6fcf3366f0518b40dce630b6351_avoslocker_cobalt-strike
Size

807KB
Sample

240923-j45gyszflm
MD5

9593e6fcf3366f0518b40dce630b6351
SHA1

7443de0765d0e97b1e31f92070fdd1746c67331f
SHA256

7d1e470e36c68e1156a7828f8002254dcde68dc61f998ab5636c12ba63f472dd
SHA512

afd962db6af6e2f3ccb6ce467431d22bb9a1209840341f07a8f2e8e724e4f1ae7da786cbe53a399fc289226796e96ec7fad43f1d6750304c6a84aae1ef8c5195
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAS:u4s+oT+NXBLi0rjFXvyHBlbiCZa8

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Malware Config

Targets

- Target
  
  2024-09-23_9593e6fcf3366f0518b40dce630b6351_avoslocker_cobalt-strike
- Size
  
  807KB
- MD5
  
  9593e6fcf3366f0518b40dce630b6351
- SHA1
  
  7443de0765d0e97b1e31f92070fdd1746c67331f
- SHA256
  
  7d1e470e36c68e1156a7828f8002254dcde68dc61f998ab5636c12ba63f472dd
- SHA512
  
  afd962db6af6e2f3ccb6ce467431d22bb9a1209840341f07a8f2e8e724e4f1ae7da786cbe53a399fc289226796e96ec7fad43f1d6750304c6a84aae1ef8c5195
- SSDEEP
  
  12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAS:u4s+oT+NXBLi0rjFXvyHBlbiCZa8
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10403) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware