General
- Target a9a99d47805f43114f84ceb1c84c9148bcbeec751a94c14cb9c1f76987bd1c09.zip
- Size 2.8MB
- Sample260923-l339ls1fmb
- SHA256 a7e6a25efc26575db86e871bff8d109571a29b3a42df07eba5cc9141c88ba88a
Score
10/10
Malware Config
Targets
-
- Target a9a99d47805f43114f84ceb1c84c9148bcbeec751a94c14cb9c1f76987bd1c09.exe
- Size 6.4MB
- SHA256 a9a99d47805f43114f84ceb1c84c9148bcbeec751a94c14cb9c1f76987bd1c09
Score10/10Family: Azov
A wiper seeking only damage, first seen in 2022.
Renames multiple (10990) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Executes dropped EXE
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1