Malware Analysis Report

2024-09-23 07:02

Sample ID 240617-blz6hs1gmp
Target b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62
SHA256 b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62
Tags
azov persistence ransomware spyware stealer wiper discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62

Threat Level: Known bad

The file b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62 was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper discovery

Azov

Renames multiple (150) files with added filename extension

Renames multiple (331) files with added filename extension

Reads user/profile data of web browsers

Modifies file permissions

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-17 01:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 01:14

Reported

2024-06-17 01:17

Platform

win7-20240611-en

Max time kernel

118s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (331) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\is.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe

"C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe"

Network

N/A

Files

memory/2080-0-0x0000000000120000-0x0000000000124000-memory.dmp

memory/2080-3-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2080-8-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2080-7-0x0000000000120000-0x0000000000124000-memory.dmp

memory/2080-6-0x00000000000E0000-0x00000000000E7000-memory.dmp

memory/2080-4-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2080-2-0x000000013F2F0000-0x000000013F337000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 01:14

Reported

2024-06-17 01:17

Platform

win10v2004-20240611-en

Max time kernel

125s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (150) files with added filename extension

ransomware

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\tk.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ga.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\Services\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\System\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nl.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\dotnet\LICENSE.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mk.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\ApproveSave.odt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\ApproveEnter.TTS C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\ConvertHide.potm C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hi.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uk.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\Common Files\Services\verisign.bmp C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tg.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe

"C:\Users\Admin\AppData\Local\Temp\b4611d6eef48a322ad0211fbd5d703c3e774a2d0833f8d22856d65fea8a4fa62.exe"

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4044,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp

Files

memory/2708-3-0x0000022453960000-0x0000022453965000-memory.dmp

memory/2708-2-0x00007FF671920000-0x00007FF671967000-memory.dmp

memory/2708-9-0x0000022453970000-0x0000022453974000-memory.dmp

memory/2708-8-0x0000022453960000-0x0000022453965000-memory.dmp

memory/2708-7-0x0000022453930000-0x0000022453937000-memory.dmp

memory/2708-0-0x0000022453970000-0x0000022453974000-memory.dmp

memory/2708-14-0x0000022453960000-0x0000022453965000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/2708-127-0x00000224559B0000-0x0000022455C20000-memory.dmp

memory/2708-430-0x00000224557A0000-0x00000224557A1000-memory.dmp

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

MD5 7a75205e137f0d4a9a492d11366c7775
SHA1 cb13900aefc924348897bd0df4ea1b9406918f0e
SHA256 3185ba2c1399a2110eaae69f1b761523cc159b2f86973edb1f307e064e84d7d0
SHA512 a108cb602ba891d7fad18dfda2ef7e6bdb7e83d42eae1925e9e0cfe8083adfa7456c35d22d94231a3f7e25af9e414e9538f58812dcf5ad890539610208b87c31

memory/2708-443-0x00000224559B0000-0x0000022455C20000-memory.dmp