Analysis
- max time kernel
91s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2022, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe
- Size 182KB
- Sample221113-gcagdsae79
- SHA256 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14
- MD5 9a5211f6e491d812d15363168783906c
- SHA1 0d06ee595404de3264da3c71f489392b64fa1e2e
- SHA512 f719f053a99c7d196e92b9743aabeee7cbdfdfb9a7a4378ddcbba27dcd7b7b6c2947bb73970f63a9fe789348f974c681a1ab9c944fa21e1a7c38a06b7b7fe237
- SSDEEP 3072:tuTO4rRZi3mvXemGXcXscjGU39Aq+ZDPUEMTlqqYhCg9QD+IZ:tkZ0mvumGX4ws9EZDPFMT2baZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\U: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\Z: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\E: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\J: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\K: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\R: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\S: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\T: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\Y: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\G: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\L: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\M: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\N: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\Q: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\V: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\W: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\B: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\F: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\H: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\X: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\A: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\I: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened (read-only) \??\P: 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\VGX\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\System\ado\msado60.tlb 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\CompressDisconnect.dwfx 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\external_extensions.json 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\CompressAdd.edrwx 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\microsoft shared\VC\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcjavas.inc 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe File created C:\Program Files\Common Files\System\msadc\RESTORE_FILES.txt 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe"C:\Users\Admin\AppData\Local\Temp\78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:2808