Malware Analysis Report

2024-09-23 06:55

Sample ID 231018-pa3n6afe55
Target 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
SHA256 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8
Tags
azov persistence ransomware wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8

Threat Level: Known bad

The file 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware wiper

Azov

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-18 12:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-18 12:08

Reported

2023-10-18 12:14

Platform

win7-20230831-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hi.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\ConvertSync.wm C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\is.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DissolveAnother.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

N/A

Files

memory/1704-1-0x00000000000E0000-0x00000000000E6000-memory.dmp

memory/1704-0-0x0000000000110000-0x0000000000114000-memory.dmp

memory/1704-3-0x0000000000100000-0x0000000000105000-memory.dmp

memory/1704-5-0x00000000FF4D0000-0x00000000FF4F4000-memory.dmp

memory/1704-4-0x0000000000110000-0x0000000000114000-memory.dmp

memory/1704-8-0x0000000000100000-0x0000000000105000-memory.dmp

memory/1704-7-0x0000000000100000-0x0000000000105000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 12:08

Reported

2023-10-18 12:14

Platform

win10v2004-20230915-en

Max time kernel

116s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\ApproveSplit.asf C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\7-Zip\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\ConvertToOptimize.zip C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hy.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\AddUse.midi C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\CompressCheckpoint.hta C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\el.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado60.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\adcjavas.inc C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tt.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

memory/3092-3-0x00000000029C0000-0x00000000029C5000-memory.dmp

memory/3092-1-0x00000000029D0000-0x00000000029D4000-memory.dmp

memory/3092-4-0x00007FF68D410000-0x00007FF68D434000-memory.dmp

memory/3092-0-0x00000000029A0000-0x00000000029A6000-memory.dmp

memory/3092-9-0x00000000029D0000-0x00000000029D4000-memory.dmp

memory/3092-11-0x00000000029C0000-0x00000000029C5000-memory.dmp

memory/3092-12-0x00000000029C0000-0x00000000029C5000-memory.dmp

C:\Program Files\7-Zip\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f