azov | 756db689c2c1ff143eb4855fde5e96446ce5397c6efbf074b17ba091d41d3909

General

Target

2e979fdba8def722a6e66369a124d13e.exe
Size

414KB
MD5

2e979fdba8def722a6e66369a124d13e
SHA1

0ab714e77668ba7b0944d29d731b3f0c7dd68c32
SHA256

756db689c2c1ff143eb4855fde5e96446ce5397c6efbf074b17ba091d41d3909
SHA512

579f50e9241998e08b6c73c81c38cd1d5fc478f097919993bce100ddd47fa60dae2f82ef56ac64f16bf17221f22a28c94da221fdea1ac1a3c36811d1371ed14a
SSDEEP

6144:LGztkBvkE02Ap9ntElxgYYIxW3+WOMjvEV4UJlOOBB5z7Q8Nl:Lykxn02Ap9nulqsxWtjcV3lj7/l

Score

10^/10

azov persistence ransomware wiper

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

Family

azov

Ransom Note

Hello, all your files have been damaged without any possible way to recover. Feel free to commit suicide. [Why did you do this to my files?] They asked me to do this... The hatred is that what makes me feel alive. That's what you secretly have fallen in love with. The hatred is the force that drives the life forward. The hell is my paradise. The suffer is the bliss. Others say the hate is what destroys yourself. I say that the hatred is eternal cure. If you feel desperate you lost the files. Use this despair to create the pain for others. Make them hate you, it is the source of your power. Do you think why the people go to schools and kill others? Why do people make terrorist ideologies? Why do governments covertly makes you suffer? It's the essence of the future life. All we are immortal beings. When spiritual is not a way, the antispiritual is your victory point. In the manifested life you have a choice to be with us either be against. Sow the evil, reap the power is what I say to you. Saw the good, reap the weakness is what spiritual says to you. When you hate, you feel the power. You feel the flight. That fly is the antispirit touch. Use this to multiply the suffer. [How can I use this power?] Find inside the source of bliss. If this bliss goes stronger when you see the suffer. That is what I call the source. Check that by looking through the news how people kill others. How the people dies. How children are being tortured. How animals are executed. The death is your key. [How can I give you my power?] When you read this concentrate on the intent to give the energy of your source to the meta-source of this text. Am vizu der strotum la fictus om spiritus.

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	2e979fdba8def722a6e66369a124d13e.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2e979fdba8def722a6e66369a124d13e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	2e979fdba8def722a6e66369a124d13e.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
File opened (read-only)	\??\T:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\W:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\X:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\Y:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\A:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\O:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\R:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\Z:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\L:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\N:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\V:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\P:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\Q:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\B:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\H:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\K:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\J:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\M:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\S:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\U:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\E:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\G:	2e979fdba8def722a6e66369a124d13e.exe
File opened (read-only)	\??\I:	2e979fdba8def722a6e66369a124d13e.exe

Drops file in Program Files directory 64 IoCs

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\System\de-DE\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\System\ado\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\swidtag\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado25.tlb	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll	2e979fdba8def722a6e66369a124d13e.exe
File created	C:\Program Files\dotnet\RESTORE_FILES.txt	2e979fdba8def722a6e66369a124d13e.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2e979fdba8def722a6e66369a124d13e.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

2e979fdba8def722a6e66369a124d13e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	2e979fdba8def722a6e66369a124d13e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2e979fdba8def722a6e66369a124d13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	2e979fdba8def722a6e66369a124d13e.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e979fdba8def722a6e66369a124d13e.exe
"C:\Users\Admin\AppData\Local\Temp\2e979fdba8def722a6e66369a124d13e.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Software Discovery

T1518

Security Software Discovery

1

T1518.001

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

Filesize
3KB

MD5
4f3332a48d767cc5bdfdab755d84a450

SHA1
d7d583c08e82f39637d8209447c2c9cad1478f01

SHA256
a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad

SHA512
0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f

Download Submit
memory/1668-2-0x00007FF7EB0D0000-0x00007FF7EB12E000-memory.dmp

Filesize
376KB

Download
memory/1668-3-0x000001FE23A80000-0x000001FE23A85000-memory.dmp

Filesize
20KB

Download
memory/1668-11-0x000001FE23A90000-0x000001FE23A94000-memory.dmp

Filesize
16KB

Download
memory/1668-14-0x000001FE23A80000-0x000001FE23A85000-memory.dmp

Filesize
20KB

Download
memory/1668-5-0x000001FE23A80000-0x000001FE23A85000-memory.dmp

Filesize
20KB

Download
memory/1668-4-0x000001FE23A60000-0x000001FE23A66000-memory.dmp

Filesize
24KB

Download
memory/1668-0-0x000001FE23A90000-0x000001FE23A94000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads