Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.(Citation: Awake Security Avaddon)(Citation: Arxiv Avaddon Feb 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f)	Attack Pattern	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19)	Attack Pattern	1
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4)	Attack Pattern	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	1
Avaddon - S0640 (58c5a3a1-928f-4094-9e98-a5a4e56dd5f3)	Malware	Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b)	Attack Pattern	1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	2
System Location Discovery - T1614 (c877e33f-1df6-40d6-b1e7-ce70f16f4979)	Attack Pattern	System Language Discovery - T1614.001 (c1b68a96-3c48-49ea-a6c0-9b27359f9c19)	Attack Pattern	2
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529)	Attack Pattern	Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	2
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073)	Attack Pattern	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	2