Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/02/2025, 16:43

250226-t8l7aawtcw 10

Analysis

  • max time kernel
    89s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/02/2025, 16:43

General

  • Target

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe

  • Size

    483KB

  • MD5

    53717dc73f61b0f9551cb62d6fca2e4a

  • SHA1

    1ca9304e86632b147852767c85c57e08bdfc8855

  • SHA256

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028

  • SHA512

    ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552

  • SSDEEP

    12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\FbRCD_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BbEdCcBbEd You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS1veHc0elRGcFZ5cHhlQzc5S1BEN0lhS1VuM1JQZkU5L2ZLVDlqam8zeDl5dXdhL1p2MXFodGFSMlE3TVRoVWUxVWV1U3pFYWEyWTJMMWc3cndnSGhlLzRiMlkwM1ViRC9CVUd3RDVIRTE0NzlSZVh5cEhSdXI2alFsaUViMmJLZ3d4dWNncmpMRlV2MVBhUXdwd0cyeTNCbGtlVEZDcnJtWkk1RGVrMVJFWmtMdVNRaktmQ3RDYWVFTGZCV1ErakRKZE4rYkVERUpRL01MSEJ1Z3BkbTZXRXcvcThTSTA2SndUeHdZazRQZWxrVjlNVjArVnZoRlU1TGVhaDZueUp5d21BSVE2R1VvNG1tVjdXSjMra1l1aWVuQ2RUekVFRVI5a3V1L2hVb0M0by9Yd0tvTFVPZXpyQldHU0h1c0FrVXY0MlUzbnBQdmZteElZNEVVeDM0WkxIU2VETCtseWI2bCsxOXBBNUw5ZFJ6YjNlOWlmc0dTT3lzc2VMZ0Fnamp0cWpBM245Z1JHV2tuMnE1OHRoTHI5eTN5VnRRMzduTVFka3MvY2c1THo3Y2lYOW1yb2RWZkd6clRaNVlVN3BObTdMUjVsOFlNS2ZlVUpieWMrZ0FHeStvNlFLR2JQRXRtbHMyT2tuM3JMdHREV1NSTDV6SDRHNnIxbWNxZEJUelNBWTVtUm5oM3N4VDVmZ1Y2UXdUNVRWeEcxZ2JHcURWQWRoYlFvSnpjRkhadUFJMWU1aG1qT0pUZGhWN09ZdjZYbTliTUFPY1gyLzBudkp1UklNWjNHUmZMeWZQWUpPbmtybEsyMVl3azByMEtrbUVBcVEzeXVVaHZoUHgxZGIwOXcyVTJENzBkSTRjYlE1M3ZiYTREMnJVejJmTTBodGpoNmZBNGZXNEZDSFZlSkNpeW5ScjlzVFhDSlRIYXQ3b0J3Z1JqeDNVUEE4c3JPbUxrcURnMEJsdkN0SjZ6RWFaMmd6UldKQ3hsazhxY0FHbmR1Z25UN203S2c2VlN4SnpJbzVGby9RcnhELzR4cmQyN1FMY1VSaVFuRUhveFhXMlNxQjd6ZUx5K2ZFbzVhbU9HNzArV2hNZUZHSjRCdW9kRXRtRHU3b1lCUjk0cXZIQnFveUlraFhQOWUvZEMzVjh4NmNYSklDakg5NTRUdmNjaUJmalB3dlBXM2NoZ2FYWEV2RnpkQWRQdmN0dlhySG9GMlprYTRNK2N3VkpGZVBoakxqWDZTRDJxV1FKR0YwTjJzcG52QkJNL1Y5QnNvMXQ2SHVDdjJJci9OeWdlUzI2MnVtK2cyN0dINUUyOFRiL1N4Y1NSOVZIZ1ZBdGxEbnRYdVFKMnVQMk9GeERycGpJblFmVkVsZHlvNU9QMmF5RFFBdzJRMGlBQlF2UTVJbmlhYklxdGFGZ3F0NlhZZk5hUEw5a3hCWGNhRWRGZnVNczJydjV6WEVwbWIrSERZdCtkNVF2Q0lpZzRGM0h2T3R2QjJUSzFZWG4yRXVsZldxNERndVZsdUUzNzYyMzRiaDRsZkt3VUFGd2RaZWJob3JRMjJHK0Vmcnpxc0diV3R5ZTdhMFlrQ2pSYjlvemFRUFNYQ05jR3d3dFRla3pRK0QyVFFlTm8rNVV0Ym50NnVhbEQwRVo0MC8zVkZlOFhOYzR0dk4wVFowZ2JUa3JMY0NxMnVYbEtKeG1LQm5PeUthQUlIZ1N3MmF4T1NHd05SWGZkeVc1cWRzMWZBZnhiV0JETGdwbEVNdXFROXVsMUExTVJtblNpN2pjRWRDaFNwdDJjRzhrZDhabXRLL0NjNXc2UVFEblNhdUdzTWF0eGFXUDY5RFAxRDlMZHVDdFZEL1RVelJvcEh1dXhralo2ZzZjbXV3UGtTcDBRNkR5ZmZLS3hSdGk1R3VoUHNkQ3JpbEluMnYyVENKbUxJY3JnTG9kaWo2MWdSOGQzeTdSS2Nkb252NEx3Q05vOFpNWGVvc000bkJISytWSGYwa2Rmc3pGVzJPRnkveWVlelJPVVVtd00xWkhYZEQ3OTIvTU1vclUxQ0hxOHcwbXZBODFjUGs3NVVGVEhKSWk3S3lZeW9iV0VEZzRKdThBVnRSYk05dFRkRUpwMzBYZ0NsaTBRcE9uTkF6eXBKMjRIalcxZzh6SUdyNDNtUT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 5
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

  • Avaddon family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (146) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
    "C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1496
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:412
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4028
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5064
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FbRCD_readme_.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4076
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WriteConvertTo.snd.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Desktop\FbRCD_readme_.txt

    Filesize

    3KB

    MD5

    366a94185a78b2adb195c877e942dc8c

    SHA1

    87e7dd005dc1d7af45751a009fbc349ac28a93f7

    SHA256

    42a26c9e90c9d7d0548094255dad2d950e360d9deb6be72146d131a7ad306eea

    SHA512

    1d7da7e684769ba8bdd79fe4a80d7cb8c54fd04ed344e4fe597caa7eb1ed843a2745b4019192a8f45d759c3b6e36ee4ee2213d91b63f60ada3a510e4de47208f

  • C:\Users\Admin\Desktop\WriteConvertTo.snd.txt

    Filesize

    896KB

    MD5

    7b4884cd4d4453652ea4c8f625368f11

    SHA1

    aaece200310760bd7a03bf07a0a60749153b9784

    SHA256

    8ec3a253fdf1eb1f09938bac7b6206f27f3720d7fafc68e118b233696504cf8c

    SHA512

    f2687cdce08a3ebfa64219983256e75a87786be5bcca6cc6023be2ecfa0d6cbf7abdc968c0bdd913fceff32c0977c8e34d84ae03610f5599cf7a9a35a4e7add9