Overview

overview

8

Static

static

PHOTO-DEVOCHKA.exe

windows7-x64

8

PHOTO-DEVOCHKA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    3ecf0ecd5da4bf1a1509bf2f44d60eebdbb17138b2613f63a80fb4adcde48959

  • Size

    122KB

  • Sample

    220919-bhcaaadhgn

  • MD5

    fecc6df13a4eb1fc90a83b0cf0073ef8

  • SHA1

    89c479f6bb8e7a5abf844e1d3ed79f8625df19c3

  • SHA256

    3ecf0ecd5da4bf1a1509bf2f44d60eebdbb17138b2613f63a80fb4adcde48959

  • SHA512

    67eeb1e46448f0b22c91a4b081a57f826c1a264bdd0c52aba768285957833e8e26c83d35aaac08a537be6961671cda5585b098055d586f33a07b052f521eee5d

  • SSDEEP

    3072:onHXMpxcGxFyhQ0bOqYJWd8qTkF9ec5KqqA5TYUC9oo:AHmGY/o0J0T0d5KY5EUooo

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-DEVOCHKA.exe

    • Size

      237KB

    • MD5

      ae0c17f7a514abdf3d6c43f49c25f91c

    • SHA1

      a4299a862e43b05c4b5ad9f9db4242c9255f2213

    • SHA256

      a935f0ceb0e9d028daa25a26179b537e6da44b39057ef908994af2a99e4f1b7c

    • SHA512

      9040aba49207c043d226327dccf5d02e2e6b47bc912ef40450969ffb3920010b9a90e73d2403ea8a76162497e31a65a787c3c25cd9e7d2ab925f6fe863be1acc

    • SSDEEP

      3072:DBAp5XhKpN4eOyVTGfhEClj8jTk+0hT6IPEaG562E3nV9uVSUO2U+Cgw5CKHq:ubXE9OiTGfhEClq9gTudJJUq

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks