Avaddon Ransomware Analysis (EN)
Tags
cmtmf-attack-pattern: Boot Or Logon Autostart Execution Command And Scripting Interpreter
maec-delivery-vectors: Watering Hole
attack-pattern: Data Abuse Elevation Control Mechanism - T1626 Abuse Elevation Control Mechanism - T1548 Boot Or Logon Autostart Execution - T1547 Bypass User Account Control - T1548.002 Command And Scripting Interpreter - T1623 Control Panel - T1218.002 Internal Defacement - T1491.001 Ip Addresses - T1590.005 Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 Native Api - T1575 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Registry Run Keys / Startup Folder - T1547.001 Server - T1583.004 Server - T1584.004 Service Execution - T1569.002 Software - T1592.002 Spearphishing Attachment - T1566.001 Spearphishing Attachment - T1598.002 System Services - T1569 Windows Service - T1543.003 Bypass User Account Control - T1088 Command-Line Interface - T1059 Execution Through Api - T1106 Modify Registry - T1112 New Service - T1050 Powershell - T1086 Registry Run Keys / Start Folder - T1060 Service Execution - T1035 Spearphishing Attachment - T1193 Windows Management Instrumentation - T1047 Spearphishing Attachment
Show in Graph
Common Information
Type Value
UUID 42c94301-4cba-41a7-930a-c76fef179d7b
Fingerprint 94961111a13ebcde
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 26, 2024, 11:55 a.m.
Added to db Sept. 26, 2024, 2:18 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Avaddon Ransomware Analysis
Title Avaddon Ransomware Analysis (EN)
Detected Hints/Tags/Attributes 82/3/22
Source URLs
Redirection Url
Details Source https://medium.com/@dogukankya/avaddon-ransomware-analysis-da90f5460b23?source=rss------cybersecurity-5
URL Provider
Details Provider Source level domain
Details medium.com medium.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 167 ✔ Cybersecurity on Medium https://medium.com/feed/tag/cybersecurity 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details File 306 
services.exe
Details File 91 
access.log
Details File 240 
wmic.exe
Details File 1208 
powershell.exe
Details File 1 
bckgrd.bmp
Details File 1122 
svchost.exe
Details MITRE ATT&CK Techniques 409 
T1566
Details MITRE ATT&CK Techniques 310 
T1566.001
Details MITRE ATT&CK Techniques 93 
T1059.007
Details MITRE ATT&CK Techniques 239 
T1106
Details MITRE ATT&CK Techniques 174 
T1569.002
Details MITRE ATT&CK Techniques 310 
T1047
Details MITRE ATT&CK Techniques 86 
T1548.002
Details MITRE ATT&CK Techniques 380 
T1547.001
Details MITRE ATT&CK Techniques 550 
T1112
Details MITRE ATT&CK Techniques 30 
T1491.001
Details Windows Registry Key 17 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Details Windows Registry Key 1 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemEnableLinkedConnections
Details Windows Registry Key 1 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemConsentPromptBehaviorAdmin
Details Windows Registry Key 47 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Details Windows Registry Key 38 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Details Windows Registry Key 20 
HKEY_CURRENT_USER\Control