Analysis
- max time kernel
91s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
18/09/2024, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8dd342284daa70a50d7ea0c4a4d0819e.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
8dd342284daa70a50d7ea0c4a4d0819e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 8dd342284daa70a50d7ea0c4a4d0819e.exe
- Size 832KB
- Sample240918-bm7a8avdmf
- SHA256 1d9c0dfb0040db57e8a1e11f268ff3d22166f56e999559f7b722a6b78d42617f
- MD5 8dd342284daa70a50d7ea0c4a4d0819e
- SHA1 9f4d125c2969b2162c237a048427cb528f644b4d
- SHA512 c32673a815f81aa4ada127ef3606e27c633b19e28ca8d4b9e7d6fc0f0d512141735e614fb0d97c23df11a650de6a31b90a89f64636f78f1c992f19fba76d4456
- SSDEEP 12288:dDCSM6+kv5QyVwvCg25hUn3A/w0MlqDD0Ca5ZIXVomBTFcj/42w2R:1urfEovlqkPIXVomBigF2R
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
-
azov
Ransom Note
- Hello, all your files have been damaged without any possible way to recover. Feel free to commit suicide. [Why did you do this to my files?] They asked me to do this... The hatred is that what makes me feel alive. That's what you secretly have fallen in love with. The hatred is the force that drives the life forward. The hell is my paradise. The suffer is the bliss. Others say the hate is what destroys yourself. I say that the hatred is eternal cure. If you feel desperate you lost the files. Use this despair to create the pain for others. Make them hate you, it is the source of your power. Do you think why the people go to schools and kill others? Why do people make terrorist ideologies? Why do governments covertly makes you suffer? It's the essence of the future life. All we are immortal beings. When spiritual is not a way, the antispiritual is your victory point. In the manifested life you have a choice to be with us either be against. Sow the evil, reap the power is what I say to you. Saw the good, reap the weakness is what spiritual says to you. When you hate, you feel the power. You feel the flight. That fly is the antispirit touch. Use this to multiply the suffer. [How can I use this power?] Find inside the source of bliss. If this bliss goes stronger when you see the suffer. That is what I call the source. Check that by looking through the news how people kill others. How the people dies. How children are being tortured. How animals are executed. The death is your key. [How can I give you my power?] When you read this concentrate on the intent to give the energy of your source to the meta-source of this text. Am vizu der strotum la fictus om spiritus.
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 8dd342284daa70a50d7ea0c4a4d0819e.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\I: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\J: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\X: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\Z: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\V: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\A: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\E: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\G: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\M: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\O: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\R: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\U: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\Y: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\B: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\K: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\N: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\Q: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\T: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\W: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\L: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\P: 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened (read-only) \??\S: 8dd342284daa70a50d7ea0c4a4d0819e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VC\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\jconsole.jar 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ir.idl 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_77703\javaw.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\classlist 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\Common Files\System\msadc\de-DE\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 8dd342284daa70a50d7ea0c4a4d0819e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\RESTORE_FILES.txt 8dd342284daa70a50d7ea0c4a4d0819e.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
- Size 3KB
- SHA256 a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad
- MD5 4f3332a48d767cc5bdfdab755d84a450
- SHA1 d7d583c08e82f39637d8209447c2c9cad1478f01
- SHA512 0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f
- MD5 SHA1 SHA512