Avaddon

How Avaddon typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Avaddon.

1. T1047 Windows Management Instrumentation Execution

   What they do: Avaddon uses wmic.exe to delete shadow copies.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1059.007 JavaScript Execution

   What they do: Avaddon has been executed through a malicious JScript downloader.

   What that means: Adversaries may abuse various implementations of JavaScript for execution.

3. T1106 Native API Execution

   What they do: Avaddon has used the Windows Crypto API to generate an AES key.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

4. T1112 Modify Registry PersistenceDefense Impairment

   What they do: Avaddon modifies several registry keys for persistence and UAC bypass.

   What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

5. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: Avaddon uses registry run keys for persistence.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

6. T1548.002 Bypass User Account Control Privilege Escalation

   What they do: Avaddon bypasses UAC using the CMSTPLUA COM interface.

   What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

7. T1027 Obfuscated Files or Information Stealth

   What they do: Avaddon has used encrypted strings.

   What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

8. T1140 Deobfuscate/Decode Files or Information Stealth

   What they do: Avaddon has decrypted encrypted strings.

   What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

9. T1685 Disable or Modify Tools Defense Impairment

   What they do: Avaddon looks for and attempts to stop anti-malware solutions.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

10. T1016 System Network Configuration Discovery Discovery

    What they do: Avaddon can collect the external IP address of the victim.

    What that means: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

11. T1057 Process Discovery Discovery

    What they do: Avaddon has collected information about running processes.

    What that means: Adversaries may attempt to get information about running processes on a system.

12. T1083 File and Directory Discovery Discovery

    What they do: Avaddon has searched for specific files prior to encryption.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

13. T1135 Network Share Discovery Discovery

    What they do: Avaddon has enumerated shared folders and mapped volumes.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

14. T1614.001 System Language Discovery Discovery

    What they do: Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

15. T1486 Data Encrypted for Impact Impact

    What they do: Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

16. T1489 Service Stop Impact

    What they do: Avaddon looks for and attempts to stop database processes.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

17. T1490 Inhibit System Recovery Impact

    What they do: Avaddon deletes backups and shadow copies using native system tools.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Avaddon has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

The note this group leaves on a compromised machine. Click a filename to read it.

-------===    Your network has been infected!    ===-------
 
 
*****************    DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED    *****************
 
 
All your documents, photos, databases and other important files have been encrypted and have the extension: {{ext}}
 
You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!
 
The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!
 
We have also downloaded a lot of private data from your network.
If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info.
 
You can get more information on our page, which is located in a Tor hidden network.
 
 
How to get to our page
--------------------------------------------------------------------------------
|
|  1. Download Tor browser - https://www.torproject.org/
|
|  2. Install Tor browser
|
|  3. Open link in Tor browser - avaddonbotrxmuyl.onion
|
|  4. Follow the instructions on this page
|
--------------------------------------------------------------------------------
 
Your ID:
--------------------------------------------------------------------------------
 
{{id}}
 
--------------------------------------------------------------------------------
 
* DO NOT TRY TO RECOVER FILES YOURSELF!
 
* DO NOT MODIFY ENCRYPTED FILES!
 
* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *

Ransom-note text from RansomLook, licensed CC BY 4.0.