Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
13/11/2022, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe
Resource
win7-20220901-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe
- Size 264KB
- Sample221113-syl8vsbe59
- SHA256 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6
- MD5 eb707c2864b47875cf7e183c738f6d1e
- SHA1 c32b4d0f7083091113991b08cd23601d9cee2c61
- SHA512 00ab31712a387e994706fea53cfd5a1fb97b3324b7bf1892218423224c0c64853c2dbf0f49181ea26d495968a2d4f89a54e0a4903c67d12409ce5425fd537258
- SSDEEP 6144:TvDq8HXs9cHhGTvG0Qc0Hz6geTB5/uwETjZVZc:TuIXs9bGWTf/kTjZc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\O: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\Q: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\U: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\W: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\E: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\F: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\G: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\H: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\I: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\K: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\L: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\S: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\T: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\X: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\Y: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\M: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\R: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\Z: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\B: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\J: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\N: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\P: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened (read-only) \??\V: 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoDev.png 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCallbacks.h 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\7-Zip\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyrun.jar 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hu.pak 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Internet Explorer\de-DE\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Java\jdk1.8.0_66\include\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\History.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fa.pak 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\System\it-IT\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\LICENSE 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Java\jdk1.8.0_66\db\bin\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\RESTORE_FILES.txt 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe"C:\Users\Admin\AppData\Local\Temp\58436826b1fbed14aa1435a74c9d1b87db7422c362e1e42b80d2b9e90ec997e6.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:3140