8c38049199ced6eb401d9ff090e51710172d9aa82550f9510fda74996c9d3917

General

Target

PHOTO-GOLAYA.exe
Size

239KB
MD5

f4eeb055f29a903de30886496d2399d0
SHA1

3f10e04a7b1884382759b252f294b6db527877c6
SHA256

802a092b98f19900cc472c08f9bc07009f16197d15f66273be6ae7fe77df0456
SHA512

d77d6fca5c1297816150b21c1c1f71080a273a2512dd657a2eff159070ff66c8fd9b7531c2f0230f489fec35a12646f9940fc3d3d4ba00b2a191a1c84454a567
SSDEEP

6144:sbXE9OiTGfhEClq9zrd52hTDOC661lYQawJJUq:IU9Xiuix1lYQaS

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1700	WScript.exe
4	1700	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.ini	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1724	1812	PHOTO-GOLAYA.exe	28
PID 1812 wrote to memory of 1724	1812	PHOTO-GOLAYA.exe	28
PID 1812 wrote to memory of 1724	1812	PHOTO-GOLAYA.exe	28
PID 1812 wrote to memory of 1724	1812	PHOTO-GOLAYA.exe	28
PID 1812 wrote to memory of 1700	1812	PHOTO-GOLAYA.exe	30
PID 1812 wrote to memory of 1700	1812	PHOTO-GOLAYA.exe	30
PID 1812 wrote to memory of 1700	1812	PHOTO-GOLAYA.exe	30
PID 1812 wrote to memory of 1700	1812	PHOTO-GOLAYA.exe	30

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:1724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking

Filesize
1KB

MD5
d5c95d3a186f4040987d0c223cb3658f

SHA1
5eb6e2da8b840a724122c7c5be0e23df4b531091

SHA256
bf3e62dcfe61f47ee835483a44f8bcef858204f11268ecab21f8ded205215816

SHA512
77468a47fbacdc590cbde28377e69e5a067081ca34d631a98b83cd219c5923d9c02a1bc123f6ddf264d02b0250133ba2c0d6b60a6e5139ab9e5991a2bb3153d3

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs

Filesize
1KB

MD5
d5c95d3a186f4040987d0c223cb3658f

SHA1
5eb6e2da8b840a724122c7c5be0e23df4b531091

SHA256
bf3e62dcfe61f47ee835483a44f8bcef858204f11268ecab21f8ded205215816

SHA512
77468a47fbacdc590cbde28377e69e5a067081ca34d631a98b83cd219c5923d9c02a1bc123f6ddf264d02b0250133ba2c0d6b60a6e5139ab9e5991a2bb3153d3

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol

Filesize
112B

MD5
a97805a7dcdf57804ebce37d2599a681

SHA1
99cfacb04b6bbe087d6c46e3d920ba9ab0a4f056

SHA256
0c6fa09a4144b4313cd2a859b98b622f836c1ea311d84aca4dcd25f706d35039

SHA512
dca01920001d10435669e51f2ba65159e9997bc0e4a3f12e0b52b66061e402194d01ac8cfd74c53499cdf59aa9f6adf3fa0e5e73b6ef1d4c0e8a5bc9955ab1c9

Download Submit
C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat

Filesize
1KB

MD5
61f1b7fb8a21fc4581e23fb2dc730b15

SHA1
5cabcd23be864415ef2f7d27df9441ffbbc1bf9d

SHA256
5ee1fe1b989948b2495be3e69d64c32979116574118236c49e456b6ae457cc05

SHA512
8258d12f1e46f1e3c1fcec3410a1f2f24a189b3dc3c132c36f6a910feaedc41a5d1790097a0cced4c15e00a76d964bf0b052ed8d50e8268a3303d5d99450df08

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
a1d6c52a1e0916a81ea593afbdb6e4a2

SHA1
246d651e3d483e5dacabd834e7e315970c80be67

SHA256
e6ae347b3530743eafc0979d3376e5c699681dc67907c60796eae0fc19eb16f3

SHA512
16e91c576be81a8a2fc69bafddf07b8792521686db8c9824efab112c82f94ed7e142c0274d907193b1d2c774cd79a13dda3a80b363b469afd161c166bb6da8b6

Download Submit
memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing