azov | c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07

General

Target

c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
Size

604KB
MD5

3577cc6664949243192fd4a5a9d84ef5
SHA1

cd13a72cbe8b86bd93ed3213f69cad8f1d59f5c8
SHA256

c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07
SHA512

2a8d0507dd4ae10d765a120bed60001f1370a71132eef8f04bca384843aac285df939ae531062170a3f57ef676f59b7fa88075db9ab33b4f579e96d321a01d7f
SSDEEP

12288:PPNcYhLgtKYU5Js9R2E18xGZn92r3PGFj7mlr:n+euK22EWxG5983eIF

Score

10^/10

azov persistence ransomware wiper

Malware Config

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

description	ioc	process
File opened (read-only)	\??\F:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\M:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\U:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\X:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\B:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\R:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\A:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\I:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\J:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\N:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\S:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\W:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\Z:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\Q:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\E:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\G:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\H:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\K:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\L:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\O:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\P:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\T:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\V:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened (read-only)	\??\Y:	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

Drops file in Program Files directory 4 IoCs

Processes:

c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File created	C:\Program Files\7-Zip\RESTORE_FILES.txt	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

C:\Users\Admin\AppData\Local\Temp\c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
"C:\Users\Admin\AppData\Local\Temp\c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:3492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-133-0x00007FF6DBED0000-0x00007FF6DBF47000-memory.dmp

Filesize
476KB

Download
memory/3492-132-0x0000016950E90000-0x0000016950E94000-memory.dmp

Filesize
16KB

Download
memory/3492-134-0x0000016950E50000-0x0000016950E57000-memory.dmp

Filesize
28KB

Download
memory/3492-135-0x0000016950E70000-0x0000016950E75000-memory.dmp

Filesize
20KB

Download
memory/3492-136-0x0000016950E90000-0x0000016950E94000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads