4d1097269c98bd3c1054b7438be959ca99de4e7d6ffb4ab17646ddad8c840b28

General

Target

GOLAYA-PHOTO.exe
Size

238KB
MD5

abba37efd3a03df55c6a615e9762f9e5
SHA1

0cbd015b62ef4a188e29d5ccc82eff6dbb75e02e
SHA256

47a9d86207338ad60e9820fe3c947485290d6138540354fd741747395229875d
SHA512

31c133da63cde479a2e16a4472a8c9bdc98db41750bc594e4165e30c87767d845dd4ecd40e064760bc1e04208f267ba0c63a8651f7278b8c2c3d29b00159cf74
SSDEEP

3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hFHPhnw4NSmNjxXyAIVragLR+ncvLn1l+C6:+bXE9OiTGfhEClq9cyHO9XFAugLKJJUm

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	3856	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	GOLAYA-PHOTO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.ini	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe	GOLAYA-PHOTO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	GOLAYA-PHOTO.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 952	3776	GOLAYA-PHOTO.exe	85
PID 3776 wrote to memory of 952	3776	GOLAYA-PHOTO.exe	85
PID 3776 wrote to memory of 952	3776	GOLAYA-PHOTO.exe	85
PID 3776 wrote to memory of 3856	3776	GOLAYA-PHOTO.exe	87
PID 3776 wrote to memory of 3856	3776	GOLAYA-PHOTO.exe	87
PID 3776 wrote to memory of 3856	3776	GOLAYA-PHOTO.exe	87

C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:952
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross

Filesize
1KB

MD5
f4b65959c7c31a3a31ca9f2080555910

SHA1
74aae7370da8db12001e4733a13eb8e01a21efd0

SHA256
a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5

SHA512
f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs

Filesize
1KB

MD5
f4b65959c7c31a3a31ca9f2080555910

SHA1
74aae7370da8db12001e4733a13eb8e01a21efd0

SHA256
a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5

SHA512
f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
6f8784f2b895a46ee40a54b47fad1349

SHA1
2b30224f5f893489f9ced2f7ba60f1d3668bba9f

SHA256
f982068db2c241f784a0ba831d664747d8445a0f5f91ee4d439fd4755e9daccd

SHA512
607f7370a664ae33111080deff3e5794de92ab55f165b259c39dba8c02190f93264bbbb0b3ef6032002ffdee4e674475957f48f1465684c52954878a0d6ec6bc

Download Submit
C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok

Filesize
99B

MD5
86dc7199339e9623d9cb19240a752740

SHA1
71cb2333efd767a21c031c23bb5b7e81115aff18

SHA256
c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

SHA512
eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
67bc55178d81571ab2195b11e2f63969

SHA1
734274c92e86e2434019235f389f75c41fcb14d0

SHA256
2d6ee3c359ab382cbd20fe4e85c460e8254e40babe35400f4259a790a8c7eacc

SHA512
5e3958075637e016f97edac81f61a9b10f9c090227ca8108cbd38753861bbb5fca19c8560032ea7291d625f66da73e3bee5be1426d119ee3343dfd76369ab525

Download Submit
memory/952-132-0x0000000000000000-mapping.dmp

Download
memory/3856-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing