Malware Analysis Report

2024-09-23 07:08

Sample ID 231018-pag3fsfd92
Target 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
SHA256 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8
Tags
azov persistence ransomware wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8

Threat Level: Known bad

The file 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware wiper

Azov

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-18 12:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:11

Platform

win7-20230831-en

Max time kernel

118s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tt.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mk.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\bod_r.TTF C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DisconnectFormat.jpe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\DVD Maker\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

N/A

Files

memory/2752-1-0x0000000000110000-0x0000000000114000-memory.dmp

memory/2752-2-0x0000000000100000-0x0000000000105000-memory.dmp

memory/2752-0-0x00000000000E0000-0x00000000000E6000-memory.dmp

memory/2752-5-0x00000000FFA00000-0x00000000FFA24000-memory.dmp

memory/2752-4-0x0000000000110000-0x0000000000114000-memory.dmp

memory/2752-11-0x0000000000100000-0x0000000000105000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-3750544865-3773649541-1858556521-1000\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f

memory/2752-18-0x0000000000100000-0x0000000000105000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:10

Platform

win10v2004-20230915-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\co.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\en.ttt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ext.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ru.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fa.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sl.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hy.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bg.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 254.211.247.8.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/4012-0-0x0000000001450000-0x0000000001454000-memory.dmp

memory/4012-1-0x0000000001420000-0x0000000001426000-memory.dmp

memory/4012-2-0x0000000001440000-0x0000000001445000-memory.dmp

memory/4012-4-0x00007FF6D0AA0000-0x00007FF6D0AC4000-memory.dmp

memory/4012-8-0x0000000001450000-0x0000000001454000-memory.dmp

memory/4012-12-0x0000000001440000-0x0000000001445000-memory.dmp

memory/4012-13-0x0000000001440000-0x0000000001445000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-919254492-3979293997-764407192-1000\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f