Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2022 05:01

General

  • Target

    febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe

  • Size

    419KB

  • MD5

    c85b63aa4526b91acc9ad26f2b142688

  • SHA1

    3adf5f527aa132e874b48a0309f1392f5730430d

  • SHA256

    febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb

  • SHA512

    5d473f4fa6a7d941038c0fa9fa07888824931f388612a7cd3591ec320ecccea204ca628ee5428d352cd7d12d93996ce34c76b3ea57bb79f2ad551c8ee0f3579a

  • SSDEEP

    12288:YDFScMV3Ws98EynVPLnDonKArpSNflx+ExlCny6e:YDkcKynVPLnDOKArpSNflxP+y6e

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe
    "C:\Users\Admin\AppData\Local\Temp\febdd0a7b6040ba8ebe0d2bbaf9c832bfe32c249189b368fcefcbdbfd27adecb.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1728-54-0x00000000000A0000-0x00000000000A4000-memory.dmp
    Filesize

    16KB

  • memory/1728-55-0x000000013F800000-0x000000013F85F000-memory.dmp
    Filesize

    380KB

  • memory/1728-56-0x0000000000070000-0x0000000000077000-memory.dmp
    Filesize

    28KB

  • memory/1728-57-0x0000000000090000-0x0000000000095000-memory.dmp
    Filesize

    20KB

  • memory/1728-58-0x00000000000A0000-0x00000000000A4000-memory.dmp
    Filesize

    16KB