Analysis

  • max time kernel
    44s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2022 06:45

General

  • Target

    cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

  • Size

    110KB

  • MD5

    914bcab4e777c2b32b7563edf0b6a7aa

  • SHA1

    eee78956f52218bec8f46b2692722a00f84dafba

  • SHA256

    cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d

  • SHA512

    8a0e5534721bedae89c738fcc43b543accb33385319ece5b9c5fd08677790392d9f89e99110462ede0575672588a395a7309e5c792d13795908228095fc858ab

  • SSDEEP

    3072:3jrvCU39gkTx4rVKPwo1YHYi3Avf3LVHoX5P5bsl0n3wX2b5RG9ru:3jjCs9MJouHFA3JoXdmy3YcUu

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
    "C:\Users\Admin\AppData\Local\Temp\cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1092-54-0x00000000000B0000-0x00000000000B4000-memory.dmp
    Filesize

    16KB

  • memory/1092-55-0x000000013FF20000-0x000000013FF36000-memory.dmp
    Filesize

    88KB

  • memory/1092-56-0x000007FEFB761000-0x000007FEFB763000-memory.dmp
    Filesize

    8KB

  • memory/1092-59-0x00000000000B0000-0x00000000000B4000-memory.dmp
    Filesize

    16KB

  • memory/1092-58-0x00000000000A0000-0x00000000000A5000-memory.dmp
    Filesize

    20KB

  • memory/1092-57-0x0000000000080000-0x0000000000087000-memory.dmp
    Filesize

    28KB