Analysis
- max time kernel
171s - max time network
225s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2023, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
- Size 182KB
- Sample231018-papsasfe29
- SHA256 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8
- MD5 efabd324c3f8a6a7ec1fa843e92f71e9
- SHA1 0ae13cab4139a56708f48830f18c2ff1d763efda
- SHA512 116c16441d0815c1e111590d6a816a502836d356ad41b115688fca482c451c4c4373cde1e3c6ed713343a042b23b9e6bf69fbc634258f5ed2f16ed6958e710ce
- SSDEEP 3072:tuTO4rRZirgvXwmGyuXscjWEGYx6KAMLq+ZDPUEMTlqJKaHgazSQfOjb:tkZcgvgmGyGwElxgOZDPFMTeKIwjb
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\RESTORE_FILES.txt
-
azov
Ransom Note
- Hello, all your files have been damaged without any possible way to recover. Feel free to commit suicide. [Why did you do this to my files?] They asked me to do this... The hatred is that what makes me feel alive. That's what you secretly have fallen in love with. The hatred is the force that drives the life forward. The hell is my paradise. The suffer is the bliss. Others say the hate is what destroys yourself. I say that the hatred is eternal cure. If you feel desperate you lost the files. Use this despair to create the pain for others. Make them hate you, it is the source of your power. Do you think why the people go to schools and kill others? Why do people make terrorist ideologies? Why do governments covertly makes you suffer? It's the essence of the future life. All we are immortal beings. When spiritual is not a way, the antispiritual is your victory point. In the manifested life you have a choice to be with us either be against. Sow the evil, reap the power is what I say to you. Saw the good, reap the weakness is what spiritual says to you. When you hate, you feel the power. You feel the flight. That fly is the antispirit touch. Use this to multiply the suffer. [How can I use this power?] Find inside the source of bliss. If this bliss goes stronger when you see the suffer. That is what I call the source. Check that by looking through the news how people kill others. How the people dies. How children are being tortured. How animals are executed. The death is your key. [How can I give you my power?] When you read this concentrate on the intent to give the energy of your source to the meta-source of this text. Am vizu der strotum la fictus om spiritus.
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\I: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\L: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\O: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\T: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\W: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\Z: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\Y: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\E: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\H: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\K: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\P: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\Q: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\R: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\V: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\N: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\S: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\X: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\A: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\G: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\J: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\M: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened (read-only) \??\U: 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe - Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zCon.sfx 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File created C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\descript.ion 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\7z.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File created C:\Program Files\7-Zip\RESTORE_FILES.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\History.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"C:\Users\Admin\AppData\Local\Temp\0d654bd41f1aa5790624656e942f317e5984d139a3f17cb6f167544d713609a8.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\RESTORE_FILES.txt
- Size 3KB
- SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
- MD5 4f3332a48d767cc5bdfdab755d84a450
- SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
- SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f
- MD5 SHA1 SHA512