Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. Avaddon

Avaddon

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.[1][2]

ID: S0640
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Matt Brenton, Zurich Global Information Security
Version: 1.0
Created: 23 August 2021
Last Modified: 25 April 2025
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1548.002Abuse Elevation Control Mechanism:Bypass User Account Control

Avaddon bypasses UAC using the CMSTPLUA COM interface.[2]

EnterpriseT1547.001Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder

Avaddon uses registry run keys for persistence.[2]

EnterpriseT1059.007Command and Scripting Interpreter:JavaScript

Avaddon has been executed through a malicious JScript downloader.[3][1]

EnterpriseT1486Data Encrypted for Impact

Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

Avaddon has decrypted encrypted strings.[2]

EnterpriseT1083File and Directory Discovery

Avaddon has searched for specific files prior to encryption.[2]

EnterpriseT1562.001Impair Defenses:Disable or Modify Tools

Avaddon looks for and attempts to stop anti-malware solutions.[2]

EnterpriseT1490Inhibit System Recovery

Avaddon deletes backups and shadow copies using native system tools.[3][2]

EnterpriseT1112Modify Registry

Avaddon modifies several registry keys for persistence and UAC bypass.[2]

EnterpriseT1106Native API

Avaddon has used the Windows Crypto API to generate an AES key.[3]

EnterpriseT1135Network Share Discovery

Avaddon has enumerated shared folders and mapped volumes.[2]

EnterpriseT1027Obfuscated Files or Information

Avaddon has used encrypted strings.[2]

EnterpriseT1057Process Discovery

Avaddon has collected information about running processes.[2]

EnterpriseT1489Service Stop

Avaddon looks for and attempts to stop database processes.[2]

EnterpriseT1614.001System Location Discovery:System Language Discovery

Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.[2]

EnterpriseT1016System Network Configuration Discovery

Avaddon can collect the external IP address of the victim.[1]

EnterpriseT1047Windows Management Instrumentation

Avaddon uses wmic.exe to delete shadow copies.[3]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp