Analysis
- max time kernel
93s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2022, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe
- Size 182KB
- Sample221108-sh76dsdbg2
- SHA256 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84
- MD5 28097ef38e5b2bbcad21becaa9b232ca
- SHA1 0daaddbd5e25c88534652819cd8ae3d75955faf3
- SHA512 ebb66ce397fc8c5d4ac641e1c1a9a38adcfeac797a3582436f7473e8e4b1363dc80fa438629573515559df3a2fcbd10a23fdf59e2263ec28fa72989c353eddee
- SSDEEP 3072:tTO4r3LixWcLiI2ptY3++OU39w8ikPEYENaIJnlmCgwl4G5DdAapUR7EL:1LGWcH2ptY3BOs92kP/TI9gCgwl4gDdN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\T: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\V: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\E: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\H: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\I: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\L: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\M: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\Y: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\B: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\S: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\X: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\Z: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\F: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\K: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\O: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\U: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\W: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\R: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\A: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\G: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\J: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\N: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened (read-only) \??\Q: 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\ExpandDeny.odp 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\BlockConvertTo.sys 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\System\en-US\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\History.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\License.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\System\ado\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\GetLock.nfo 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\GetStep.wmf 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\Services\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\ado\msador28.tlb 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\descript.ion 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe File created C:\Program Files\Common Files\System\ado\de-DE\RESTORE_FILES.txt 5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe"C:\Users\Admin\AppData\Local\Temp\5fe41e533a89cbf6c659eb78b221f24c4827b834a877f72c0ee34a5a0fd80b84.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:884