Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 01:29
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-RUSSKAYA.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
GOLAYA-RUSSKAYA.exe
Resource
win10v2004-20220812-en
General
-
Target
GOLAYA-RUSSKAYA.exe
-
Size
239KB
-
MD5
146ac45dce81221d82db28de10793609
-
SHA1
262c1b1c7a214d029e08176e62dc91cce12cf0bf
-
SHA256
859b1ec0db6c55f95692c7a95a50e7d40adfe696595567b99c32436ba9af7c38
-
SHA512
49b344399e1aef4bc3493e624831d3c4b7155cdb8f88eb41cb70e9b00d4ebb8234f72e78e030bca6c7616c136b331c42f7fd167025e0d3faca195d2b5bfb7a14
-
SSDEEP
6144:CbXE9OiTGfhEClq9cpRM1qcVVx/Zs3JJUq:qU9Xiui++X
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 7 2604 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation GOLAYA-RUSSKAYA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.ini GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs cmd.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\Uninstall.exe GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\lethala fell blowsinisterby somefell.chanc GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs cmd.exe File created C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\everybody_lie_life_is_life.gol GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.striking GOLAYA-RUSSKAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings GOLAYA-RUSSKAYA.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 812 wrote to memory of 2324 812 GOLAYA-RUSSKAYA.exe 80 PID 812 wrote to memory of 2324 812 GOLAYA-RUSSKAYA.exe 80 PID 812 wrote to memory of 2324 812 GOLAYA-RUSSKAYA.exe 80 PID 812 wrote to memory of 2604 812 GOLAYA-RUSSKAYA.exe 82 PID 812 wrote to memory of 2604 812 GOLAYA-RUSSKAYA.exe 82 PID 812 wrote to memory of 2604 812 GOLAYA-RUSSKAYA.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\ustanovi menya plllll\life is life\when_we_a_fill_the_power.bat" "2⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
PID:2324
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\ustanovi menya plllll\life is life\Tocausetofallby.vbs"2⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
PID:2604
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564f237344c6ec7c9857ce618f75c2468
SHA156be9ae28388e63c9bed4b3a23aaf292fb06f887
SHA256596c0d5d299acc49cfb5d533cc85dfe6d1322ceae84c2cbb85a9f1ab9720a428
SHA512754646cbe9ea6580ded2fc658adc09a01ebeab66bd76d7b9bc41323796d0282ebe990e4c22209b99bf4f61a4df1d9e44fa57de77ec402be11004ffda90208554
-
Filesize
1KB
MD564f237344c6ec7c9857ce618f75c2468
SHA156be9ae28388e63c9bed4b3a23aaf292fb06f887
SHA256596c0d5d299acc49cfb5d533cc85dfe6d1322ceae84c2cbb85a9f1ab9720a428
SHA512754646cbe9ea6580ded2fc658adc09a01ebeab66bd76d7b9bc41323796d0282ebe990e4c22209b99bf4f61a4df1d9e44fa57de77ec402be11004ffda90208554
-
Filesize
112B
MD5a97805a7dcdf57804ebce37d2599a681
SHA199cfacb04b6bbe087d6c46e3d920ba9ab0a4f056
SHA2560c6fa09a4144b4313cd2a859b98b622f836c1ea311d84aca4dcd25f706d35039
SHA512dca01920001d10435669e51f2ba65159e9997bc0e4a3f12e0b52b66061e402194d01ac8cfd74c53499cdf59aa9f6adf3fa0e5e73b6ef1d4c0e8a5bc9955ab1c9
-
Filesize
1KB
MD5e080a606a6c2814b1b5364b0fa70db53
SHA1077d33bddeb8cd822d5e36113e235a21bf9d1fc9
SHA25688208228a485c4745102116f61ba5569308818d6acdf2ff4a1a911c1d8b35590
SHA51229d9f50db169b396a590ae22d1a0569ba1d5024c6111a42e861daa839ac03f62604c8a77bb31cbb4f0a7ce447d87ff0d9dd2caa72d6fe345cd547a93d464dd35
-
Filesize
1KB
MD5a1d6c52a1e0916a81ea593afbdb6e4a2
SHA1246d651e3d483e5dacabd834e7e315970c80be67
SHA256e6ae347b3530743eafc0979d3376e5c699681dc67907c60796eae0fc19eb16f3
SHA51216e91c576be81a8a2fc69bafddf07b8792521686db8c9824efab112c82f94ed7e142c0274d907193b1d2c774cd79a13dda3a80b363b469afd161c166bb6da8b6