Analysis

  • max time kernel
    56s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2022 06:09

General

  • Target

    c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe

  • Size

    604KB

  • MD5

    3577cc6664949243192fd4a5a9d84ef5

  • SHA1

    cd13a72cbe8b86bd93ed3213f69cad8f1d59f5c8

  • SHA256

    c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07

  • SHA512

    2a8d0507dd4ae10d765a120bed60001f1370a71132eef8f04bca384843aac285df939ae531062170a3f57ef676f59b7fa88075db9ab33b4f579e96d321a01d7f

  • SSDEEP

    12288:PPNcYhLgtKYU5Js9R2E18xGZn92r3PGFj7mlr:n+euK22EWxG5983eIF

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe
    "C:\Users\Admin\AppData\Local\Temp\c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    PID:4836

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4836-133-0x00007FF63DB20000-0x00007FF63DB97000-memory.dmp
    Filesize

    476KB

  • memory/4836-132-0x000001482C9B0000-0x000001482C9B4000-memory.dmp
    Filesize

    16KB

  • memory/4836-134-0x000001482C970000-0x000001482C977000-memory.dmp
    Filesize

    28KB

  • memory/4836-135-0x000001482C990000-0x000001482C995000-memory.dmp
    Filesize

    20KB

  • memory/4836-136-0x000001482C9B0000-0x000001482C9B4000-memory.dmp
    Filesize

    16KB