Malware Analysis Report

2024-09-23 07:08

Sample ID 231018-papgjafe28
Target 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
SHA256 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8
Tags
azov persistence ransomware wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8

Threat Level: Known bad

The file 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware wiper

Azov

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-18 12:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:10

Platform

win7-20230831-en

Max time kernel

122s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DissolveAnother.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

N/A

Files

memory/1924-1-0x0000000000190000-0x0000000000194000-memory.dmp

memory/1924-0-0x0000000000070000-0x0000000000076000-memory.dmp

memory/1924-2-0x0000000000180000-0x0000000000185000-memory.dmp

memory/1924-5-0x00000000FF3F0000-0x00000000FF414000-memory.dmp

memory/1924-4-0x0000000000190000-0x0000000000194000-memory.dmp

memory/1924-11-0x0000000000180000-0x0000000000185000-memory.dmp

memory/1924-13-0x0000000000180000-0x0000000000185000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:11

Platform

win10v2004-20230915-en

Max time kernel

139s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Signatures

Azov

ransomware wiper azov

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\CompleteJoin.m4v C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\7-Zip\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VGX\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msador28.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cy.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gu.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sl.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\yo.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hy.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\DisconnectEnter.aif C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe

"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 254.177.238.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp

Files

memory/856-0-0x0000000001640000-0x0000000001644000-memory.dmp

memory/856-1-0x0000000001610000-0x0000000001616000-memory.dmp

memory/856-2-0x0000000001630000-0x0000000001635000-memory.dmp

memory/856-5-0x00007FF7B5F90000-0x00007FF7B5FB4000-memory.dmp

memory/856-4-0x0000000001640000-0x0000000001644000-memory.dmp

memory/856-11-0x0000000001630000-0x0000000001635000-memory.dmp

memory/856-12-0x0000000001630000-0x0000000001635000-memory.dmp

F:\$RECYCLE.BIN\S-1-5-21-1141987721-3945596982-3297311814-1000\RESTORE_FILES.txt

MD5 4f3332a48d767cc5bdfdab755d84a450
SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f