azov | 2073b1abb03741af1abba88e0ccd311a3ede19d89bcf1f029606e93545f59f69 | Triage

Sharing

General

Target

2024-08-17_756ef468f3b055f47c81c2d4cac7cc06_ryuk
Size

1.8MB
Sample

240817-q3n7xa1glm
MD5

756ef468f3b055f47c81c2d4cac7cc06
SHA1

075ebf52eb79a5b227964435ffe03db76a69dd91
SHA256

2073b1abb03741af1abba88e0ccd311a3ede19d89bcf1f029606e93545f59f69
SHA512

ec40e5da7ba005f33a00afb38aaeb5ae4750ca2895dcc44fa56f7dac38dd65567c54e118f9d76e33fd2684b53b8ee6f70530a0aa3097bc85eb7fe9a870083c28
SSDEEP

49152:jZH42U78NgjpUAQjqdURLDLy0cdakz1D15:ltNgjpMRL/mx5

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  2024-08-17_756ef468f3b055f47c81c2d4cac7cc06_ryuk
- Size
  
  1.8MB
- MD5
  
  756ef468f3b055f47c81c2d4cac7cc06
- SHA1
  
  075ebf52eb79a5b227964435ffe03db76a69dd91
- SHA256
  
  2073b1abb03741af1abba88e0ccd311a3ede19d89bcf1f029606e93545f59f69
- SHA512
  
  ec40e5da7ba005f33a00afb38aaeb5ae4750ca2895dcc44fa56f7dac38dd65567c54e118f9d76e33fd2684b53b8ee6f70530a0aa3097bc85eb7fe9a870083c28
- SSDEEP
  
  49152:jZH42U78NgjpUAQjqdURLDLy0cdakz1D15:ltNgjpMRL/mx5
Score

10^/10

azov persistence ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarewiper

behavioral2