General

  • Target

    test.exe

  • Size

    1.1MB

  • Sample

    241225-cebp1stnfx

  • MD5

    bc78307b49282fd1039a09c88f5e57d9

  • SHA1

    56ca25bc143ec38871fa5e96561437755a9d0de9

  • SHA256

    06918af465e607aa81a46042c24e6a8c45d7c983f33ee621caad6b25464dd27a

  • SHA512

    af4d43f05b3583d07fb96e0815bcc5624e7e3eb110981a21ff82ec07829bcdfd3d23c7de1b673a41bfb41ac20614f27a28389aed80f75a4399c52b351ba5b5f5

  • SSDEEP

    24576:u4s+oT+NXBLi0rjFXvyHBlbmCZa8Ch1972J1+i3DO2gik:uioT+NXVFjxvMBlbmya8CF4TO2K

Malware Config

Targets

    • Target

      test.exe

    • Size

      1.1MB

    • MD5

      bc78307b49282fd1039a09c88f5e57d9

    • SHA1

      56ca25bc143ec38871fa5e96561437755a9d0de9

    • SHA256

      06918af465e607aa81a46042c24e6a8c45d7c983f33ee621caad6b25464dd27a

    • SHA512

      af4d43f05b3583d07fb96e0815bcc5624e7e3eb110981a21ff82ec07829bcdfd3d23c7de1b673a41bfb41ac20614f27a28389aed80f75a4399c52b351ba5b5f5

    • SSDEEP

      24576:u4s+oT+NXBLi0rjFXvyHBlbmCZa8Ch1972J1+i3DO2gik:uioT+NXVFjxvMBlbmya8CF4TO2K

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    • Avoslocker family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (10388) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks