Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
18-10-2023 12:14
Static task
static1
Behavioral task
behavioral1
Sample
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe
Resource
win10v2004-20230915-en
General
-
Target
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe
-
Size
226KB
-
MD5
40abae097e4b962c31f10cc69058e037
-
SHA1
fdb57137fbcce8d12c61c028b9ee05eae737117c
-
SHA256
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee
-
SHA512
8f37b111d83f6813021c71da7103ddd359e7993f49eebf371b3cf6687c334050bad7d86dca19fe1d0f9c84c968495dc6542db00480774f3b64ec4dddbd9be457
-
SSDEEP
6144:6Ts3ElxgfMN5TpndRhoCGtcTBnvqPQ4nR:6YUlqffcTxvqPQ4nR
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
azov
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exedescription ioc process File opened (read-only) \??\A: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\B: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\M: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\N: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\T: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\U: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\V: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\E: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\G: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\H: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\K: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\O: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\X: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\L: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\Q: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\R: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\S: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\W: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\Y: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\I: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\J: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\P: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened (read-only) \??\Z: 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\System\fr-FR\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Internet Explorer\en-US\eula.rtf 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\RESTORE_FILES.txt 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar 1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe"C:\Users\Admin\AppData\Local\Temp\1bbdb72b6e00156fffd0e13986a36ce48bac8ce7cdde6793fb696763f696d0ee.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txtFilesize
3KB
MD54f3332a48d767cc5bdfdab755d84a450
SHA1d7d583c08e82f39637d8209447c2c9cad1478f01
SHA256a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
SHA5120f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f
-
memory/2568-1-0x0000000000180000-0x0000000000186000-memory.dmpFilesize
24KB
-
memory/2568-3-0x0000000000420000-0x0000000000425000-memory.dmpFilesize
20KB
-
memory/2568-0-0x0000000000430000-0x0000000000434000-memory.dmpFilesize
16KB
-
memory/2568-4-0x000000013FA40000-0x000000013FA73000-memory.dmpFilesize
204KB
-
memory/2568-6-0x0000000000430000-0x0000000000434000-memory.dmpFilesize
16KB
-
memory/2568-9-0x0000000000420000-0x0000000000425000-memory.dmpFilesize
20KB
-
memory/2568-7-0x0000000000420000-0x0000000000425000-memory.dmpFilesize
20KB
-
memory/2568-157-0x0000000003000000-0x0000000006000000-memory.dmpFilesize
48.0MB
-
memory/2568-284-0x0000000003000000-0x0000000006000000-memory.dmpFilesize
48.0MB
-
memory/2568-502-0x0000000001E40000-0x0000000001E41000-memory.dmpFilesize
4KB