Analysis
-
max time kernel
141s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
rdpclient.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rdpclient.exe
Resource
win10v2004-20220812-en
General
-
Target
rdpclient.exe
-
Size
113KB
-
MD5
8737c6601c30b2ed49b51d6b53e2ea3e
-
SHA1
d9521390d87bd895c78d16f573bfa6863ce46e2c
-
SHA256
9a952abaa9e8bc4676e2c8e53774d15198e4b9163bebf37a0bc2e238e49f2f98
-
SHA512
ab451844a8d6d57e34b2825db9bc8c669a1dd83db6bb7d98b37919da26a45b815d9c1544eed00eea8190255dc9edc7f42cdb5dde8f92b9df14309a3cbcad1ec2
-
SSDEEP
1536:lxhjgDHJewOvXuhi3ugCXjQzZ28Tx4rUbu60l+uMh8c9n5P3vrOTaTlonDQgWPI:la4aU39FHTx4rd60fS8cd5P3viCYDQ0
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rdpclient.exedescription ioc process File renamed C:\Users\Admin\Pictures\TestSkip.tif => C:\Users\Admin\Pictures\TestSkip.tif.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\ExitClose.png => C:\Users\Admin\Pictures\ExitClose.png.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\InvokeSearch.tiff => C:\Users\Admin\Pictures\InvokeSearch.tiff.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\PushInitialize.crw => C:\Users\Admin\Pictures\PushInitialize.crw.azov rdpclient.exe File opened for modification C:\Users\Admin\Pictures\ResolveEnter.tiff rdpclient.exe File renamed C:\Users\Admin\Pictures\ResolveEnter.tiff => C:\Users\Admin\Pictures\ResolveEnter.tiff.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\SyncLimit.png => C:\Users\Admin\Pictures\SyncLimit.png.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\EnableClose.raw => C:\Users\Admin\Pictures\EnableClose.raw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\OpenRestore.crw => C:\Users\Admin\Pictures\OpenRestore.crw.azov rdpclient.exe File opened for modification C:\Users\Admin\Pictures\InvokeSearch.tiff rdpclient.exe File renamed C:\Users\Admin\Pictures\ReceiveRename.png => C:\Users\Admin\Pictures\ReceiveRename.png.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\SuspendGrant.raw => C:\Users\Admin\Pictures\SuspendGrant.raw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\ConvertFromGet.crw => C:\Users\Admin\Pictures\ConvertFromGet.crw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\ReadUndo.crw => C:\Users\Admin\Pictures\ReadUndo.crw.azov rdpclient.exe -
Drops startup file 1 IoCs
Processes:
rdpclient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt rdpclient.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rdpclient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" rdpclient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rdpclient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rdpclient.exedescription ioc process File opened (read-only) \??\S: rdpclient.exe File opened (read-only) \??\T: rdpclient.exe File opened (read-only) \??\X: rdpclient.exe File opened (read-only) \??\G: rdpclient.exe File opened (read-only) \??\K: rdpclient.exe File opened (read-only) \??\Z: rdpclient.exe File opened (read-only) \??\F: rdpclient.exe File opened (read-only) \??\O: rdpclient.exe File opened (read-only) \??\L: rdpclient.exe File opened (read-only) \??\M: rdpclient.exe File opened (read-only) \??\N: rdpclient.exe File opened (read-only) \??\Q: rdpclient.exe File opened (read-only) \??\R: rdpclient.exe File opened (read-only) \??\U: rdpclient.exe File opened (read-only) \??\B: rdpclient.exe File opened (read-only) \??\H: rdpclient.exe File opened (read-only) \??\Y: rdpclient.exe File opened (read-only) \??\I: rdpclient.exe File opened (read-only) \??\J: rdpclient.exe File opened (read-only) \??\P: rdpclient.exe File opened (read-only) \??\V: rdpclient.exe File opened (read-only) \??\W: rdpclient.exe File opened (read-only) \??\A: rdpclient.exe File opened (read-only) \??\E: rdpclient.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rdpclient.exedescription ioc process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon rdpclient.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14565_.GIF rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoBeta.png rdpclient.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\THMBNAIL.PNG rdpclient.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js rdpclient.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090087.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXT rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF rdpclient.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif rdpclient.exe File created C:\Program Files\Windows Sidebar\en-US\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt rdpclient.exe File created C:\Program Files (x86)\Windows Defender\it-IT\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301252.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF rdpclient.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml rdpclient.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif rdpclient.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png rdpclient.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\PREVIEW.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00633_.WMF rdpclient.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hr.pak rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4 rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB7.BDR rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\gadget.xml rdpclient.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\PREVIEW.GIF rdpclient.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF rdpclient.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099151.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CASHREG.WAV rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.XML rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF rdpclient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1896-54-0x0000000000110000-0x0000000000114000-memory.dmpFilesize
16KB
-
memory/1896-55-0x000000013FDD0000-0x000000013FDE7000-memory.dmpFilesize
92KB
-
memory/1896-58-0x0000000000110000-0x0000000000114000-memory.dmpFilesize
16KB
-
memory/1896-57-0x0000000000100000-0x0000000000105000-memory.dmpFilesize
20KB
-
memory/1896-56-0x00000000000E0000-0x00000000000E7000-memory.dmpFilesize
28KB