azov | febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb

General

Target

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
Size

419KB
MD5

c85b63aa4526b91acc9ad26f2b142688
SHA1

3adf5f527aa132e874b48a0309f1392f5730430d
SHA256

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb
SHA512

5d473f4fa6a7d941038c0fa9fa07888824931f388612a7cd3591ec320ecccea204ca628ee5428d352cd7d12d93996ce34c76b3ea57bb79f2ad551c8ee0f3579a
SSDEEP

12288:YDFScMV3Ws98EynVPLnDonKArpSNflx+ExlCny6e:YDkcKynVPLnDOKArpSNflxP+y6e

Score

10^/10

azov persistence ransomware wiper

Malware Config

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
File opened (read-only)	\??\H:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\T:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\U:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Z:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\O:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\P:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\S:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\V:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\A:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\B:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\G:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\J:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Q:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\R:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\W:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\Y:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\E:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\F:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\M:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\N:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\I:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\K:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\L:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened (read-only)	\??\X:	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

Drops file in Program Files directory 18 IoCs

Processes:

febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File created	C:\Program Files\7-Zip\RESTORE_FILES.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File created	C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
"C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:2736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-132-0x0000025838A30000-0x0000025838A34000-memory.dmp

Filesize
16KB

Download
memory/2736-133-0x00007FF7B7170000-0x00007FF7B71CF000-memory.dmp

Filesize
380KB

Download
memory/2736-136-0x0000025838A30000-0x0000025838A34000-memory.dmp

Filesize
16KB

Download
memory/2736-135-0x0000025838A20000-0x0000025838A25000-memory.dmp

Filesize
20KB

Download
memory/2736-134-0x0000025838A00000-0x0000025838A07000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads