Resubmissions
24-11-2022 15:21
221124-srn4wafg8w 1010-11-2022 09:00
221110-kyppzsgdh2 1030-10-2022 18:47
221030-xe9bhaecd3 6Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
ie_to_edge_stub.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ie_to_edge_stub.exe
Resource
win10v2004-20220901-en
General
-
Target
ie_to_edge_stub.exe
-
Size
544KB
-
MD5
ffee009b572a16093cfffe7f8e3d963a
-
SHA1
c499d2778dc2746a08ef90d259e2f6834ed17cdf
-
SHA256
9435b7a2b884676ec7e109ed28a9164cea5f5f6d4a18e1b2cebaff1de4c186db
-
SHA512
e3916649143e0976f5b553c23818918307fc63bfcac070ea9ed5119c68192cabd6faddb2b895915bdd19203ae2754c815fb4537e3b77342378ae4f9b7f4669f6
-
SSDEEP
12288:+klqkuX7nP1Lkp2gKXTMxq9b5it9KMR+F96l0fPUn:+klqN79Lkonw09b5icj6APUn
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\RESTORE_FILES.txt
azov
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ie_to_edge_stub.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ie_to_edge_stub.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" ie_to_edge_stub.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ie_to_edge_stub.exedescription ioc process File opened (read-only) \??\S: ie_to_edge_stub.exe File opened (read-only) \??\T: ie_to_edge_stub.exe File opened (read-only) \??\Z: ie_to_edge_stub.exe File opened (read-only) \??\G: ie_to_edge_stub.exe File opened (read-only) \??\H: ie_to_edge_stub.exe File opened (read-only) \??\N: ie_to_edge_stub.exe File opened (read-only) \??\K: ie_to_edge_stub.exe File opened (read-only) \??\P: ie_to_edge_stub.exe File opened (read-only) \??\Q: ie_to_edge_stub.exe File opened (read-only) \??\V: ie_to_edge_stub.exe File opened (read-only) \??\A: ie_to_edge_stub.exe File opened (read-only) \??\E: ie_to_edge_stub.exe File opened (read-only) \??\J: ie_to_edge_stub.exe File opened (read-only) \??\U: ie_to_edge_stub.exe File opened (read-only) \??\X: ie_to_edge_stub.exe File opened (read-only) \??\Y: ie_to_edge_stub.exe File opened (read-only) \??\I: ie_to_edge_stub.exe File opened (read-only) \??\O: ie_to_edge_stub.exe File opened (read-only) \??\R: ie_to_edge_stub.exe File opened (read-only) \??\M: ie_to_edge_stub.exe File opened (read-only) \??\W: ie_to_edge_stub.exe File opened (read-only) \??\B: ie_to_edge_stub.exe File opened (read-only) \??\F: ie_to_edge_stub.exe File opened (read-only) \??\L: ie_to_edge_stub.exe