Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 17:03

General

  • Target

    PHOTO-GOLAYA.exe

  • Size

    181KB

  • MD5

    c1eac9961bf688d75ec96b4d38eedfde

  • SHA1

    af7224a1329c61d9057496428cb95c7cebb3f584

  • SHA256

    de19911598a83d5b504cf7b4c24f5f6f8b68dcc6b72b8f79c3b2d353c93accfd

  • SHA512

    c0f76c82c57da5f52deafd3c7b6ec17dcf9653d4ac7f488645743cd61f43dcf196d6647fa6de2345c8ada61a03aeba2b73d9bdd7162689df0a816311ebc9e01a

  • SSDEEP

    3072:xBAp5XhKpN4eOyVTGfhEClj8jTk+0hUEQT3a3:0bXE9OiTGfhEClq9rEQo

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
    "C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\OnmywaytoHamburg.bat" "
      2⤵
      • Drops file in Drivers directory
      PID:756
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\all.vbs"
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      PID:4996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\OnmywaytoHamburg.bat

    Filesize

    2KB

    MD5

    6dae3e7a8ec299860ea4ca69c3a03896

    SHA1

    32b43c32f05b1525ebd11339ad53da3b0b9404e9

    SHA256

    843673700074de749911e4b68daa38b8cabf9d300379cd3668c8e77e891cb94f

    SHA512

    1b210000eb2ddf955e99a845872297a52fb39853776818916f87da8bbf170d45f7f9f1ae72f2f3d97f3a8ff85ddeca36183bb65077259ddfb1ab92dc6cf6f559

  • C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\all.vbs

    Filesize

    938B

    MD5

    f8c2225f1121b68e271a39a8565890d6

    SHA1

    a86e56dd4dcb1365e4ae1f82fb5adba401b0b785

    SHA256

    5ac006c7a6c545d091d4343bfb8b8dac6de9b1c3ef036041a95dfc1e4daccc4e

    SHA512

    5043e920becdda1b09f4bca98f85ea47652f91243071ea81d69bd23b11554c4bc32888555add549d71f53d0edb54249465662cb9ec25d7a4ff750d882184973c

  • C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers comprehensive\planningandinforma.tion

    Filesize

    74B

    MD5

    e4de17733467b756874acd58408f91ce

    SHA1

    d565a19054a630b4e1c770c6448df88c97273642

    SHA256

    7e7fad021ec3258e61252983d4fb6da573233d4c94f146079ee545b65965456b

    SHA512

    7daa8a5b65d9c905f214cbe1f824e3408b5ca42302f1b534f54d0f0ecc5235a44e41b729a7e3283b93ac886831c809bbb8d989685e12a30c211577d9cb182d12

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    c103de0bdd559496de273a00bd9b6806

    SHA1

    7da2e899d8d1c6110495602364375fb800012e21

    SHA256

    9351acf3b7ab24de41196bef296b951acb91338c428a4da92f3885ecdd19c1f0

    SHA512

    6548f7499649c5fd6324379f348e4e5a9df1b0cd103609d3453c901e4d10e70ebc182cef131a75dd53cc73a15ebfe1e36cde4005e488879900d552da5511eb19