Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
PHOTO-GOLAYA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PHOTO-GOLAYA.exe
Resource
win10v2004-20220812-en
General
-
Target
PHOTO-GOLAYA.exe
-
Size
181KB
-
MD5
c1eac9961bf688d75ec96b4d38eedfde
-
SHA1
af7224a1329c61d9057496428cb95c7cebb3f584
-
SHA256
de19911598a83d5b504cf7b4c24f5f6f8b68dcc6b72b8f79c3b2d353c93accfd
-
SHA512
c0f76c82c57da5f52deafd3c7b6ec17dcf9653d4ac7f488645743cd61f43dcf196d6647fa6de2345c8ada61a03aeba2b73d9bdd7162689df0a816311ebc9e01a
-
SSDEEP
3072:xBAp5XhKpN4eOyVTGfhEClj8jTk+0hUEQT3a3:0bXE9OiTGfhEClq9rEQo
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 4996 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation PHOTO-GOLAYA.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\all.vbs PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\planningandinforma.tion PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\OnmywaytoHamburg.bat PHOTO-GOLAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings PHOTO-GOLAYA.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1064 wrote to memory of 756 1064 PHOTO-GOLAYA.exe 78 PID 1064 wrote to memory of 756 1064 PHOTO-GOLAYA.exe 78 PID 1064 wrote to memory of 756 1064 PHOTO-GOLAYA.exe 78 PID 1064 wrote to memory of 4996 1064 PHOTO-GOLAYA.exe 80 PID 1064 wrote to memory of 4996 1064 PHOTO-GOLAYA.exe 80 PID 1064 wrote to memory of 4996 1064 PHOTO-GOLAYA.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\OnmywaytoHamburg.bat" "2⤵
- Drops file in Drivers directory
PID:756
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\all.vbs"2⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
PID:4996
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\OnmywaytoHamburg.bat
Filesize2KB
MD56dae3e7a8ec299860ea4ca69c3a03896
SHA132b43c32f05b1525ebd11339ad53da3b0b9404e9
SHA256843673700074de749911e4b68daa38b8cabf9d300379cd3668c8e77e891cb94f
SHA5121b210000eb2ddf955e99a845872297a52fb39853776818916f87da8bbf170d45f7f9f1ae72f2f3d97f3a8ff85ddeca36183bb65077259ddfb1ab92dc6cf6f559
-
Filesize
938B
MD5f8c2225f1121b68e271a39a8565890d6
SHA1a86e56dd4dcb1365e4ae1f82fb5adba401b0b785
SHA2565ac006c7a6c545d091d4343bfb8b8dac6de9b1c3ef036041a95dfc1e4daccc4e
SHA5125043e920becdda1b09f4bca98f85ea47652f91243071ea81d69bd23b11554c4bc32888555add549d71f53d0edb54249465662cb9ec25d7a4ff750d882184973c
-
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\planningandinforma.tion
Filesize74B
MD5e4de17733467b756874acd58408f91ce
SHA1d565a19054a630b4e1c770c6448df88c97273642
SHA2567e7fad021ec3258e61252983d4fb6da573233d4c94f146079ee545b65965456b
SHA5127daa8a5b65d9c905f214cbe1f824e3408b5ca42302f1b534f54d0f0ecc5235a44e41b729a7e3283b93ac886831c809bbb8d989685e12a30c211577d9cb182d12
-
Filesize
1KB
MD5c103de0bdd559496de273a00bd9b6806
SHA17da2e899d8d1c6110495602364375fb800012e21
SHA2569351acf3b7ab24de41196bef296b951acb91338c428a4da92f3885ecdd19c1f0
SHA5126548f7499649c5fd6324379f348e4e5a9df1b0cd103609d3453c901e4d10e70ebc182cef131a75dd53cc73a15ebfe1e36cde4005e488879900d552da5511eb19