Skip to content

Hide Navigation Hide TOC

Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.(Citation: Awake Security Avaddon)(Citation: Arxiv Avaddon Feb 2021)

Cluster A Galaxy A Cluster B Galaxy B Level
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b) Attack Pattern 1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3) Malware Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern 1
System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19) Attack Pattern System Location Discovery - T1614 (c877e33f-1df6-40d6-b1e7-ce70f16f4979) Attack Pattern 2
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) Attack Pattern Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern 2