avoslocker | 44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb | Triage

Sharing

General

Target

generated_script.exe
Size

56.0MB
Sample

241215-ays3as1jgq
MD5

0743d55a94100e93c80e9ad6201f7f60
SHA1

2e8ad959c55b407bd67a8cb88e93f3cd670cc1af
SHA256

44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
SHA512

4b69c923f9ffca887c1dc4904864015ca1e3e8dd05b828b4830acf7b1e349cf3260b82db0c601658fe6732aed622614a3a1d2353555e42d906c49e97879afacc
SSDEEP

196608:8mKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:mu81olYdQdF3MnG38GrNs

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact pyinstaller ransomware

Malware Config

Targets

- Target
  
  generated_script.exe
- Size
  
  56.0MB
- MD5
  
  0743d55a94100e93c80e9ad6201f7f60
- SHA1
  
  2e8ad959c55b407bd67a8cb88e93f3cd670cc1af
- SHA256
  
  44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
- SHA512
  
  4b69c923f9ffca887c1dc4904864015ca1e3e8dd05b828b4830acf7b1e349cf3260b82db0c601658fe6732aed622614a3a1d2353555e42d906c49e97879afacc
- SSDEEP
  
  196608:8mKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:mu81olYdQdF3MnG38GrNs
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8507) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware