Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18-10-2023 12:13
Static task
static1
Behavioral task
behavioral1
Sample
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe
Resource
win10v2004-20230915-en
General
-
Target
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe
-
Size
637KB
-
MD5
edbbc8a24aa520b1b045dbbfeeac876d
-
SHA1
29b699ca9254225c0964960f5d06d27cb8968f58
-
SHA256
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c
-
SHA512
0a25369a11a95f4a3f4542b5bdc1a11a6dc39bad451e9d0adfc783b7c6fbfede13bf3ef618902a901b1bb7bf2de5157c7b97341e9430c94112276851acee1183
-
SSDEEP
12288:tJLspSYnEv2GvWuYas950mXTErnXkAueICO9jiW:/IpFnEvCuYMwKXaLhiW
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exedescription ioc process File opened (read-only) \??\A: 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened (read-only) \??\B: 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened (read-only) \??\E: 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe -
Drops file in Program Files directory 45 IoCs
Processes:
07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exedescription ioc process File created C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File created C:\Program Files\7-Zip\RESTORE_FILES.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\descript.ion 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\History.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe"C:\Users\Admin\AppData\Local\Temp\07365141d711dcff5c65be5f23bdaf4f01d1b7a95bf1103169518e3c999e434c.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3056-1-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/3056-0-0x0000000000190000-0x0000000000194000-memory.dmpFilesize
16KB
-
memory/3056-3-0x0000000000160000-0x0000000000165000-memory.dmpFilesize
20KB
-
memory/3056-4-0x000000013FA70000-0x000000013FAF0000-memory.dmpFilesize
512KB
-
memory/3056-9-0x0000000000190000-0x0000000000194000-memory.dmpFilesize
16KB
-
memory/3056-11-0x0000000000160000-0x0000000000165000-memory.dmpFilesize
20KB
-
memory/3056-12-0x0000000000160000-0x0000000000165000-memory.dmpFilesize
20KB