General

  • Target

    sex.exe

  • Size

    1.1MB

  • Sample

    241229-aetjqawld1

  • MD5

    e3032317d2a145c136f058ec87c5fc1d

  • SHA1

    b48e669d85ea84ba2741f4cf3f14266cfcb018ad

  • SHA256

    f9d9f113a6820af874e4c3a3ac90c001b157ddfeff76914b1f1e744be1d1f4f7

  • SHA512

    f5f0625abe1947ef17dccb052bdc5cad7a3fb85b0ca0a2ca74f41dcc810a01a13529c994c7be3377448ed833f71b65bc526923fdc0e18ca63bf0efa8bc14abb8

  • SSDEEP

    24576:KImw98okVgela0as5CqLVO7XJCjkD3N0HRA:0L5ljasaU

Malware Config

Targets

    • Target

      sex.exe

    • Size

      1.1MB

    • MD5

      e3032317d2a145c136f058ec87c5fc1d

    • SHA1

      b48e669d85ea84ba2741f4cf3f14266cfcb018ad

    • SHA256

      f9d9f113a6820af874e4c3a3ac90c001b157ddfeff76914b1f1e744be1d1f4f7

    • SHA512

      f5f0625abe1947ef17dccb052bdc5cad7a3fb85b0ca0a2ca74f41dcc810a01a13529c994c7be3377448ed833f71b65bc526923fdc0e18ca63bf0efa8bc14abb8

    • SSDEEP

      24576:KImw98okVgela0as5CqLVO7XJCjkD3N0HRA:0L5ljasaU

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    • Avoslocker family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (10409) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks