72c41702b7e66ef7f274bdca45112c7ac1234a2aaf2bc195f81fe0b812e58969

General

Target

GOLAYA-BABE.exe
Size

239KB
MD5

759cb81096a6fde1b9ede08255248159
SHA1

cff5496d52b61098a04251c050c6e04b5ad13178
SHA256

9a00a517d51a4750fefc9fa7bb471a7ab9de1fbaf3d37ade6442682987a628a9
SHA512

8c44879a5a58addae21e521a87b5a3c6a466abb71dfc7e3db3026331f6b49cbbc27df4fc8f9e74cfcc1e69e64660bfd5cb3a0bf7096e48a385b9fa9df06c3794
SSDEEP

3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0hijkEDboYxU044U/1K+Cgw5CKHy:HbXE9OiTGfhEClq9YEXoyDjURJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	740	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	GOLAYA-BABE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.ini	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-BABE.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-BABE.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-BABE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	GOLAYA-BABE.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5024	4992	GOLAYA-BABE.exe	79
PID 4992 wrote to memory of 5024	4992	GOLAYA-BABE.exe	79
PID 4992 wrote to memory of 5024	4992	GOLAYA-BABE.exe	79
PID 4992 wrote to memory of 740	4992	GOLAYA-BABE.exe	81
PID 4992 wrote to memory of 740	4992	GOLAYA-BABE.exe	81
PID 4992 wrote to memory of 740	4992	GOLAYA-BABE.exe	81

C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:5024
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross

Filesize
1KB

MD5
353b66dd45fa71e77b883b8d8f77a3cc

SHA1
27d2a73d0ebbca97ce8f1582b22f66e7abc0be0b

SHA256
b7b57a9ddf44852f88ff8da468bac62b6302ada2eaa8b24006e0b4bfb099cdba

SHA512
ded5a1f17560f2a7bc5e1a765162bcfd827eea0b9073c9ad8e88c8c706494174bc8fea01dc95df34b798f5847deb822cd98b51bc3dc7f4104343d0480503d203

Download Submit
C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs

Filesize
1KB

MD5
353b66dd45fa71e77b883b8d8f77a3cc

SHA1
27d2a73d0ebbca97ce8f1582b22f66e7abc0be0b

SHA256
b7b57a9ddf44852f88ff8da468bac62b6302ada2eaa8b24006e0b4bfb099cdba

SHA512
ded5a1f17560f2a7bc5e1a765162bcfd827eea0b9073c9ad8e88c8c706494174bc8fea01dc95df34b798f5847deb822cd98b51bc3dc7f4104343d0480503d203

Download Submit
C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
6daad30db16dca2393e95dc79993b935

SHA1
539786a8fc9d50a02c4d0299a88ce7c09ed414c1

SHA256
97c36a9e98886b271bd479fde0f384b75ef04399ebd1554d2490966d56d385d9

SHA512
ed9d7b8b3d14fc2136dd28788874446559f388e591c20d7e2e343a5a1d96bc1af46e6586da0a78ad0bcd15c9a170aad9d37c4b0dd840298b117b51ab7dac22a8

Download Submit
C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok

Filesize
94B

MD5
192f4e93e60c4e559b075e5f9c2776f6

SHA1
ae3b367b8ebb97ce4d4324a951072872d16ac422

SHA256
6b85eb0052d703b4f2eef6279bc4c6ea1bca7a91ff966ee5f5c899b09e999b06

SHA512
f861f34f0e513acdcda92da757974c1bfb8624bebb10563a94c9ef02340bd264ee8267be9730ad3cec9f527c54cccc31b2a71da83369e31ac454aaae71360198

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
f2c5d10ad27bb489a71a16e71b70e8b4

SHA1
5154928e4445092cedd422c549817c7a50e59d76

SHA256
e085c03394954c9b369c0a6f8704062b3c6ab932208fe6061e7a5a5bac851428

SHA512
2f01c24aa2cc579b5d77c13a6b2af9f76738f7868c30a665ea0a4759d80032fbb451a1bbf406554223898a3c2ca586d4749a10b445823f28ef0585acbe57edf9

Download Submit

Analysis

Sharing