Malware Analysis Report

2024-09-23 06:58

Sample ID 221114-gn6c7sac9x
Target 2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe
SHA256 2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b

Threat Level: Known bad

The file 2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-11-14 05:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-14 05:58

Reported

2022-11-14 06:00

Platform

win7-20220812-en

Max time kernel

43s

Max time network

45s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe"

Signatures

Azov

ransomware wiper azov

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\de.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ko.pak C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\el.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-BR.pak C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\EnableJoin.vssm C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe

"C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe"

Network

N/A

Files

memory/896-54-0x0000000000290000-0x0000000000294000-memory.dmp

memory/896-55-0x00000000FF550000-0x00000000FF574000-memory.dmp

memory/896-56-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

memory/896-59-0x0000000000290000-0x0000000000294000-memory.dmp

memory/896-58-0x0000000000280000-0x0000000000285000-memory.dmp

memory/896-57-0x0000000000260000-0x0000000000267000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-14 05:58

Reported

2022-11-14 06:00

Platform

win10v2004-20220901-en

Max time kernel

91s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uk.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmprph.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\ConfirmRedo.emf C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nl.txt C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe

"C:\Users\Admin\AppData\Local\Temp\2bc8579bb843386dd0198069bb54e4abebbe9e2cc0ab2fae2f1386fb4b70cd1b.exe"

Network

Country Destination Domain Proto
N/A 104.80.225.205:443 tcp
N/A 20.42.65.89:443 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp
N/A 209.197.3.8:80 tcp

Files

memory/4788-132-0x0000000001370000-0x0000000001374000-memory.dmp

memory/4788-133-0x00007FF645D90000-0x00007FF645DB4000-memory.dmp

memory/4788-134-0x0000000001340000-0x0000000001347000-memory.dmp

memory/4788-135-0x0000000001360000-0x0000000001365000-memory.dmp

memory/4788-136-0x0000000001370000-0x0000000001374000-memory.dmp