azov | 6928bbde585b1c63cc629894a491a6d4c34369296b25b58575c2e344ab0f0d2d

General

Target

2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
Size

664KB
MD5

609998fbaac38b33e17c04d3624b085f
SHA1

a127bc0ec9976eb64f18164bfc01d9e4fa930b3b
SHA256

6928bbde585b1c63cc629894a491a6d4c34369296b25b58575c2e344ab0f0d2d
SHA512

45f7928ea49fe803acb2023a04a9eebca6543512bf9c543841b10978a1babb62ee9e6aa066a3206e3a0cca1d89b4ad3da96ef7b9c98ce0c80111135bd487256d
SSDEEP

12288:is9qAF5ISoCU5qJSr1eoEUiPqfWBgA0igcAaHUzTshGzS2uLk:dQSoCU5qJSr1eoECOBgA0igczeTJCLk

Score

10^/10

azov persistence ransomware wiper

Malware Config

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\A:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\O:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\P:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\V:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\B:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\L:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\R:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\W:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\K:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\N:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\Q:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\S:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\E:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\G:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\H:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\J:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\T:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\U:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\Y:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\I:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\M:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened (read-only)	\??\X:	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File created	C:\Program Files\7-Zip\RESTORE_FILES.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File created	C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_609998fbaac38b33e17c04d3624b085f_ryuk.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\RESTORE_FILES.txt

Filesize
2KB

MD5
78ede93114e65f9160fd03d3357c56e6

SHA1
88d531b101e57655f1d0d26c6b3257aa2468d460

SHA256
c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5

SHA512
074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Download Submit
memory/3176-0-0x0000024DFADC0000-0x0000024DFADC4000-memory.dmp

Filesize
16KB

Download
memory/3176-3-0x0000024DF9780000-0x0000024DF9785000-memory.dmp

Filesize
20KB

Download
memory/3176-5-0x0000024DF9780000-0x0000024DF9785000-memory.dmp

Filesize
20KB

Download
memory/3176-7-0x0000024DF9780000-0x0000024DF9785000-memory.dmp

Filesize
20KB

Download
memory/3176-4-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

Filesize
2.0MB

Download
memory/3176-2-0x00007FF74C150000-0x00007FF74C1E7000-memory.dmp

Filesize
604KB

Download
memory/3176-12-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

Filesize
2.0MB

Download
memory/3176-13-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

Filesize
2.0MB

Download
memory/3176-16-0x0000024DFADC0000-0x0000024DFADC4000-memory.dmp

Filesize
16KB

Download
memory/3176-63-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads