Malware Analysis Report

2024-09-23 07:02

Sample ID 240620-bjc8zazgqa
Target 9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571
SHA256 9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571

Threat Level: Known bad

The file 9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571 was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (565) files with added filename extension

Renames multiple (1046) files with added filename extension

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 01:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 01:10

Reported

2024-06-20 01:12

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (1046) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\he.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Internet Explorer\SIGNUP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13 C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe

"C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe"

C:\Program Files\Java\jre7\bin\javaws.exe

C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe

Network

N/A

Files

memory/1812-0-0x00000000001E0000-0x00000000001E7000-memory.dmp

memory/1812-1-0x0000000000210000-0x0000000000214000-memory.dmp

memory/1812-3-0x000000013F840000-0x000000013F8C6000-memory.dmp

memory/1812-12-0x0000000000210000-0x0000000000214000-memory.dmp

memory/1812-11-0x0000000000200000-0x0000000000205000-memory.dmp

memory/1812-6-0x0000000000200000-0x0000000000205000-memory.dmp

memory/1812-4-0x0000000000200000-0x0000000000205000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 01:10

Reported

2024-06-20 01:12

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (565) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\dotnet\LICENSE.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\System\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\lib\tools.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\System\uk-UA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\DebugConvertFrom.mp4 C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\th.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\eu.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tg.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VGX\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kk.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sw.pak C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaws.exe N/A
N/A N/A C:\Program Files\Java\jre-1.8\bin\javaws.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe

"C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe"

C:\Program Files\Java\jre-1.8\bin\javaws.exe

C:\Users\Admin\AppData\Local\Temp\9f67b7defeab351ea049d62dc8f94a67e05e615fbcd7debc89681cf4cb4fe571.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/732-2-0x00007FF721C90000-0x00007FF721D16000-memory.dmp

memory/732-9-0x0000018F21630000-0x0000018F21637000-memory.dmp

memory/732-10-0x0000018F21650000-0x0000018F21655000-memory.dmp

memory/732-14-0x0000018F21650000-0x0000018F21655000-memory.dmp

memory/732-11-0x0000018F21660000-0x0000018F21664000-memory.dmp

memory/732-3-0x0000018F21650000-0x0000018F21655000-memory.dmp

memory/732-0-0x0000018F21660000-0x0000018F21664000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d