Avalon — AI-Assisted Modular Malware Framework with CrownX Ransomware

Avalon is a previously undocumented, modular malware framework that bundles credential theft, lateral movement, remote access, recovery disruption, and ransomware under one umbrella. Its ransomware component is internally named CrownX. Researchers noted signs of AI-assisted development — a further example of how AI lowers the barrier to building capable malware. An early Avalon artifact was uploaded to VirusTotal on 2026-03-11 with zero detections, and public reporting landed on 2026-07-03.

The intrusion begins with a spoofed legal-document email pointing to a password-protected archive on Proton Drive. Inside is an ISO image (not a direct attachment, to dodge mail-layer inspection) containing a document-themed shortcut, e.g. Secure Document CA-283505.pdf.lnk. Opening the shortcut launches an MSBuild project from the ISO, which loads an embedded .NET assembly, tampers with Event Tracing for Windows (ETW), downloads the next stage over HTTPS, and deploys the Avalon framework. Avalon carries an extensive defense-evasion subsystem with tailored logic to conceal execution from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender.

Avalon harvests credentials broadly — Chromium/Firefox browsers (creds, cookies, history), crypto wallets (MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum, Atomic Wallet, Ledger Live, Bitcoin Core), Discord/Slack/Teams, OpenVPN/WireGuard, Windows Credential Manager, SSH known_hosts, saved RDP, Wi-Fi profiles, and Group Policy Preferences cpassword artifacts. The CrownX stage encrypts via the Windows Cryptography API, terminates the Volume Shadow Copy Service and deletes shadow copies, drops a ransom note with a deadline timer, runs an anti-forensic cleanup subsystem, and performs direct disk interaction to damage partition/boot records. Command-and-control and exfiltration use helloxcherry[.]com.

Defender priority: Because Avalon is fresh and hashes are not yet broadly published, lead with behaviour: MSBuild launched from a mounted ISO / removable volume, MSBuild making outbound network connections (LOLBin proxy exec + download), shadow-copy deletion / VSS stop / bcdedit recovery tamper (the CrownX pre-encryption tell), and DNS to helloxcherry[.]com. Ensure offline/immutable backups exist before an incident — recovery disruption is the whole point of the CrownX stage.

Intel maturity: Avalon reporting is fresh and (so far) single-primary-vendor; broad file-hash IOCs are not yet published (the referenced VT sample had zero detections). This pack therefore weights behavioural detections over atomic hashes. The one durable atomic IOC is the C2 domain helloxcherry[.]com; the LNK name (Secure Document CA-283505.pdf.lnk) is a per-lure value — hunt the .pdf.lnk double-extension pattern rather than the exact string. Re-hunt when hashes and a YARA rule are published.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A process deleted volume shadow copies (vssadmin / wmic / wbadmin). CrownX pre-encryption — T1490.
2. H2 (high): The Volume Shadow Copy Service was stopped or disabled. Covers T1490 / T1489.
3. H3 (high): bcdedit disabled recovery / boot-status recovery. Covers T1490.
4. H4 (high): A host resolved helloxcherry[.]com. Atomic C2 — T1071.001.
5. H5 (medium): MSBuild.exe was launched by a shell/interpreter with a project file — LOLBin inline-task exec. Covers T1127.001 / T1218.
6. H6 (medium): MSBuild.exe made an outbound network connection — proxy download / C2. Covers T1127.001.
7. H7 (medium): A process executed from a mounted ISO / removable volume launched by explorer. ISO/LNK delivery — T1204.002.
8. H8 (medium): A *.pdf.lnk double-extension shortcut was written to disk. Lure artifact.
9. H9 (medium): Windows event logs were cleared / USN journal deleted. Anti-forensic — T1070.001 / T1070.

Attack chain

Atomic indicators are sparse by design — Avalon is fresh and broad hashes are not yet published. Values below trace to The Hacker News report. Treat behaviour (§8) as the primary coverage and re-hunt when a hash set / YARA rule lands.

• Mail gateway: Search the last 90 days for inbound emails linking to drive.proton.me / Proton Drive shares, especially "legal document" / invoice lures with password-protected archives. Flag any archive containing an .iso / .img.
• ISO/IMG mount events: Review Windows Microsoft-Windows-VHDMP / partition-mount events for user-initiated ISO mounts followed quickly by an .lnk or MSBuild.exe launch.
• ETW / logging tamper: Alert on autologger registry edits, logman stop/delete, and gaps in EDR/ETW telemetry that coincide with a new process tree.
• Credential-store access: Hunt for non-browser processes reading browser Login Data, wallet directories (MetaMask/Exodus/Electrum/Ledger Live), and SYSVOL Groups.xml containing cpassword.
• Backup integrity: Confirm offline/immutable backups exist and that backup accounts are segmented — CrownX explicitly targets recovery and backup systems.

Promotion path: Q1 and Q3 are safe to run in detect and escalate to block quickly on workstation policies (recovery inhibition has near-zero legitimate use there). Validate Q5/Q6/Q7 against a dev/build baseline before promoting. Q4 domain → Custom IOC Management (block).

One-click blocks for SOC tooling. Atomic IOCs are limited (fresh threat); behavioural signatures carry the coverage. Re-hunt when a hash set / YARA rule is published.

type,value,action,severity,expiration,description,tags
domain,helloxcherry.com,detect,high,2026-10-31,Avalon C2 / exfil,framework:Avalon;ransomware:CrownX

[ Avalon / CrownX behaviors ]
- MSBuild.exe launched by explorer/script host with a .csproj/.xml
- MSBuild.exe making an outbound network connection
- Process executing off a removable / mounted-ISO volume via explorer
- *.pdf.lnk / *.doc.lnk double-extension shortcut written to disk
- vssadmin/wmic/wbadmin delete shadows or catalog
- VSS / swprv service stopped or disabled
- bcdedit recoveryenabled no / bootstatuspolicy ignoreallfailures
- wevtutil cl / fsutil usn deletejournal (anti-forensic)
- DNS/HTTPS to helloxcherry[.]com

Framework:  Avalon (modular, AI-assisted development)
Ransomware: CrownX (Windows Crypto API; recovery + backup targeting)
Delivery:   Proton Drive archive -> ISO -> *.pdf.lnk -> MSBuild
Modules:    credential theft, lateral movement, remote access,
            recovery disruption, ransomware
Wallets:    MetaMask, Phantom, Coinbase, Exodus, Electrum,
            Atomic, Ledger Live, Bitcoin Core
Evades:     Defender, SentinelOne, CrowdStrike, Sophos, Elastic,
            FortiEDR, ESET, McAfee, Bitdefender
C2:         helloxcherry[.]com

[ ] Offline / immutable backups verified & restore-tested
[ ] WDAC/AppLocker blocks MSBuild.exe for non-developers
[ ] ISO/IMG auto-mount disabled or restricted via policy
[ ] Mail gateway strips ISO/IMG and flags Proton Drive share links
[ ] ASR: block executable content from email/webmail (enforce)
[ ] Controlled Folder Access + Defender tamper protection on
[ ] Proxy denies / alerts on helloxcherry[.]com
[ ] Rotate creds if compromise suspected (browsers, wallets, VPN, chat)

• Telemetry ready: Confirm ProcessRollup2, NetworkConnectIP4, DnsRequest, and FileCreateInfo are flowing from in-scope Windows hosts.
• Benign baseline: Run Q5/Q6 (MSBuild) and Q7 (removable-volume exec) over 7–14 days; record developer/build-server hosts and media-provisioning workflows, and exclude them before alerting.
• Positive test: In a lab, run vssadmin delete shadows /all /quiet and bcdedit /set {default} recoveryenabled no — confirm Q1 and Q3 fire; write a file named test.pdf.lnk and confirm Q8 fires.
• Promotion: Promote Q1/Q3 to detect/block on workstation policies immediately; hold Q5/Q6/Q7 until the dev/build baseline is clean.

P1 · AppLocker — deny MSBuild.exe for non-developers

<!-- Deny the MSBuild dev-utility LOLBin path. Link to a NON-DEVELOPER OU only. -->
<!-- Import: Group Policy -> Computer Configuration -> Windows Settings -> Security
     Settings -> Application Control Policies -> AppLocker -> Executable Rules -->
<!-- SHIPS AS AuditOnly ON PURPOSE. Run it for at least a week and review EventID
     8003 before flipping EnforcementMode to "Enabled". -->
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
  <!-- Microsoft default allow rules -- DO NOT REMOVE. Without them, enforcing this
       collection blocks every executable on the machine, including your RMM agent. -->
  <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default) All files in Program Files"
                Description="Allows Everyone to run applications in Program Files."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%PROGRAMFILES%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default) All files in Windows"
                Description="Allows Everyone to run applications in the Windows folder."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%WINDIR%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default) All files -- Administrators"
                Description="Allows local Administrators to run all applications."
                UserOrGroupSid="S-1-5-32-544" Action="Allow">
    <Conditions><FilePathCondition Path="*" /></Conditions>
  </FilePathRule>

  <!-- MSBuild ships in several locations. Any developer machine, or any host running a .NET build agent or Visual Studio, will break -- link this to a non-developer OU. -->
  <FilePathRule Id="4b1e9a30-2c77-4f18-9e64-51a0c2d7b911" Name="Deny MSBuild.exe for standard users"
                Description="Avalon / CrownX abuse of MSBuild as a trusted compiler LOLBin"
                UserOrGroupSid="S-1-5-32-545" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%WINDIR%\Microsoft.NET\Framework\*\MSBuild.exe" />
      <FilePathCondition Path="%WINDIR%\Microsoft.NET\Framework64\*\MSBuild.exe" />
      <FilePathCondition Path="%PROGRAMFILES%\Microsoft Visual Studio\*\MSBuild.exe" />
    </Conditions>
  </FilePathRule>
</RuleCollection>

Prerequisites: the Application Identity service (AppIDSvc) must be Running/Automatic, set via GPO -- AppLocker evaluates nothing without it. Pilot OU. Reboot required: no (gpupdate /force to refresh policy).

Verify: during the AuditOnly week, review Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL for EventID 8003 (would-have-blocked). Zero unexpected entries means it is safe to set EnforcementMode="Enabled"; a real block then logs EventID 8004.

Rollback: set EnforcementMode="NotConfigured" and re-import, or unlink the GPO and run gpupdate /force. If a host is already locked out by an over-broad policy, boot to Safe Mode (AppLocker does not enforce there) and stop AppIDSvc, or delete %WINDIR%\System32\AppLocker\*.AppLocker.

P2 · Disable ISO/IMG auto-mount (remove the mount handler)

# Prevent double-click auto-mount of .iso / .img containers.
# HKCR handler removal (deploy via GPO Preferences / MDM):
reg delete "HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount" /f
reg delete "HKEY_CLASSES_ROOT\Windows.VhdFile\shell\mount" /f
# Verify: opening an .iso should no longer expose a "Mount" verb.

P3 · ASR — block executable content from email/webmail (enforce)

Add-MpPreference -AttackSurfaceReductionRules_Ids `
  BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled
# Controlled Folder Access + tamper protection:
Set-MpPreference -EnableControlledFolderAccess Enabled
# Verify:
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

P4 · Snapshot current shadow-copy / recovery state (pre-incident baseline)

# Capture a baseline so a later CrownX deletion is obvious.
vssadmin list shadows
bcdedit /enum '{default}' | Select-String 'recoveryenabled','bootstatuspolicy'
Get-Service -Name VSS | Select-Object Name, Status, StartType

Coverage is strongest on the recovery-inhibition chain (Q1/Q3, low-FP and safe to block) and the atomic C2 domain. MSBuild-loader and ISO-delivery hunts need a dev/build baseline. Credential harvesting and the final encryption/disk-wipe are gaps best caught upstream at the recovery-disruption step (the last quiet moment before impact) and via §7 native hunts — which is exactly why Q1–Q3 are the priority alerts.