General
- Target HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z
- Size 2.2MB
- Sample250402-tmvxassmy5
- SHA256 1640dbb1202916848fa226c543ee4abf6a3c24f357548f4cfcb41319b153803e
Score
10/10
Malware Config
Targets
-
- Target HEUR-Trojan-Ransom.Win32.Avaddon.vho-7b7c16367746efe7583ae46235b2f062ce44602dda990c9a11a730d619b8d365.7z
- Size 2.2MB
- SHA256 1640dbb1202916848fa226c543ee4abf6a3c24f357548f4cfcb41319b153803e
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Avaddon payload
-
UAC bypass
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1