Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2022 01:29

General

  • Target

    GOLAYA-RUSSKAYA.exe

  • Size

    239KB

  • MD5

    146ac45dce81221d82db28de10793609

  • SHA1

    262c1b1c7a214d029e08176e62dc91cce12cf0bf

  • SHA256

    859b1ec0db6c55f95692c7a95a50e7d40adfe696595567b99c32436ba9af7c38

  • SHA512

    49b344399e1aef4bc3493e624831d3c4b7155cdb8f88eb41cb70e9b00d4ebb8234f72e78e030bca6c7616c136b331c42f7fd167025e0d3faca195d2b5bfb7a14

  • SSDEEP

    6144:CbXE9OiTGfhEClq9cpRM1qcVVx/Zs3JJUq:qU9Xiui++X

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      PID:2324
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      PID:2604

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking

    Filesize

    1KB

    MD5

    64f237344c6ec7c9857ce618f75c2468

    SHA1

    56be9ae28388e63c9bed4b3a23aaf292fb06f887

    SHA256

    596c0d5d299acc49cfb5d533cc85dfe6d1322ceae84c2cbb85a9f1ab9720a428

    SHA512

    754646cbe9ea6580ded2fc658adc09a01ebeab66bd76d7b9bc41323796d0282ebe990e4c22209b99bf4f61a4df1d9e44fa57de77ec402be11004ffda90208554

  • C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs

    Filesize

    1KB

    MD5

    64f237344c6ec7c9857ce618f75c2468

    SHA1

    56be9ae28388e63c9bed4b3a23aaf292fb06f887

    SHA256

    596c0d5d299acc49cfb5d533cc85dfe6d1322ceae84c2cbb85a9f1ab9720a428

    SHA512

    754646cbe9ea6580ded2fc658adc09a01ebeab66bd76d7b9bc41323796d0282ebe990e4c22209b99bf4f61a4df1d9e44fa57de77ec402be11004ffda90208554

  • C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol

    Filesize

    112B

    MD5

    a97805a7dcdf57804ebce37d2599a681

    SHA1

    99cfacb04b6bbe087d6c46e3d920ba9ab0a4f056

    SHA256

    0c6fa09a4144b4313cd2a859b98b622f836c1ea311d84aca4dcd25f706d35039

    SHA512

    dca01920001d10435669e51f2ba65159e9997bc0e4a3f12e0b52b66061e402194d01ac8cfd74c53499cdf59aa9f6adf3fa0e5e73b6ef1d4c0e8a5bc9955ab1c9

  • C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat

    Filesize

    1KB

    MD5

    e080a606a6c2814b1b5364b0fa70db53

    SHA1

    077d33bddeb8cd822d5e36113e235a21bf9d1fc9

    SHA256

    88208228a485c4745102116f61ba5569308818d6acdf2ff4a1a911c1d8b35590

    SHA512

    29d9f50db169b396a590ae22d1a0569ba1d5024c6111a42e861daa839ac03f62604c8a77bb31cbb4f0a7ce447d87ff0d9dd2caa72d6fe345cd547a93d464dd35

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    a1d6c52a1e0916a81ea593afbdb6e4a2

    SHA1

    246d651e3d483e5dacabd834e7e315970c80be67

    SHA256

    e6ae347b3530743eafc0979d3376e5c699681dc67907c60796eae0fc19eb16f3

    SHA512

    16e91c576be81a8a2fc69bafddf07b8792521686db8c9824efab112c82f94ed7e142c0274d907193b1d2c774cd79a13dda3a80b363b469afd161c166bb6da8b6

  • memory/2324-132-0x0000000000000000-mapping.dmp

  • memory/2604-136-0x0000000000000000-mapping.dmp