azov | cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d

General

Target

cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
Size

110KB
MD5

914bcab4e777c2b32b7563edf0b6a7aa
SHA1

eee78956f52218bec8f46b2692722a00f84dafba
SHA256

cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d
SHA512

8a0e5534721bedae89c738fcc43b543accb33385319ece5b9c5fd08677790392d9f89e99110462ede0575672588a395a7309e5c792d13795908228095fc858ab
SSDEEP

3072:3jrvCU39gkTx4rVKPwo1YHYi3Avf3LVHoX5P5bsl0n3wX2b5RG9ru:3jjCs9MJouHFA3JoXdmy3YcUu

Score

10^/10

azov persistence ransomware wiper

Malware Config

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

description	ioc	process
File opened (read-only)	\??\B:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\K:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\N:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\P:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\Y:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\S:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\U:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\A:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\E:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\F:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\L:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\M:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\G:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\Q:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\R:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\Z:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\V:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\W:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\X:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\H:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\I:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\J:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\O:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened (read-only)	\??\T:	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

Drops file in Program Files directory 64 IoCs

Processes:

cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\System\msadc\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado27.tlb	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adojavas.inc	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\mr.pak	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fi.pak	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\CompareRestart.mpp	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\System\ado\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\RESTORE_FILES.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hu.pak	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe

C:\Users\Admin\AppData\Local\Temp\cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe
"C:\Users\Admin\AppData\Local\Temp\cfe9b79faf455e5ba96d1949d24af3bc4ea4671ade277df1a9674ab538c62c9d.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-132-0x0000029E14A30000-0x0000029E14A34000-memory.dmp

Filesize
16KB

Download
memory/4612-133-0x00007FF7CE620000-0x00007FF7CE636000-memory.dmp

Filesize
88KB

Download
memory/4612-136-0x0000029E14A30000-0x0000029E14A34000-memory.dmp

Filesize
16KB

Download
memory/4612-135-0x0000029E14A20000-0x0000029E14A25000-memory.dmp

Filesize
20KB

Download
memory/4612-134-0x0000029E14A00000-0x0000029E14A07000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads