18f07899a2e7d4267371ab06a2b7cb7bbb312501db1007d70e664380a76dab27

General

Target

GOLAYA-PHOTO.exe
Size

149KB
MD5

0196884e4ae0fc48c9bf5f8260502466
SHA1

40a78aeb8bcd7abd24088e1103ac3b292c30992a
SHA256

20621acdaf45c4cbcdeb972a78a8baca5cb0327489da84523c406a1e740ec7ab
SHA512

cb9a56c4c3415c955befeaedcf83e92fbe768e1bcef07d280f0c5a3f047bbc6f9dc58532c4562088ee44bd8ec69acba371e22f42b92319517bd4d1cb6a66a55f
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiHZYpz4PIsa:AbXE9OiTGfhEClq9k54PId

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1552	WScript.exe
5	1552	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\slusat\suffaling\nerabotaert.life	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\bautmyside.txt	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\sitbaby.vbs	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\slonik.pokakal	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\podkluchidruga.bat	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\ebanettkebanet.vbs	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\lit.vbs	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\slusat\suffaling\Uninstall.exe	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\slusat\suffaling\Uninstall.ini	GOLAYA-PHOTO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 948	1964	GOLAYA-PHOTO.exe	28
PID 1964 wrote to memory of 948	1964	GOLAYA-PHOTO.exe	28
PID 1964 wrote to memory of 948	1964	GOLAYA-PHOTO.exe	28
PID 1964 wrote to memory of 948	1964	GOLAYA-PHOTO.exe	28
PID 948 wrote to memory of 1552	948	cmd.exe	30
PID 948 wrote to memory of 1552	948	cmd.exe	30
PID 948 wrote to memory of 1552	948	cmd.exe	30
PID 948 wrote to memory of 1552	948	cmd.exe	30
PID 1964 wrote to memory of 624	1964	GOLAYA-PHOTO.exe	31
PID 1964 wrote to memory of 624	1964	GOLAYA-PHOTO.exe	31
PID 1964 wrote to memory of 624	1964	GOLAYA-PHOTO.exe	31
PID 1964 wrote to memory of 624	1964	GOLAYA-PHOTO.exe	31

C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\slusat\suffaling\podkluchidruga.bat" "
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\slusat\suffaling\sitbaby.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\slusat\suffaling\ebanettkebanet.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\slusat\suffaling\ebanettkebanet.vbs

Filesize
884B

MD5
7e070563d0c8bf0f083b07d68389f706

SHA1
47b6834223c5597774a3a045dedece938f4a2e48

SHA256
54001e5eb3ccd7cda65ca05e1cdeab43e22db8fd05d8d80759bf6fee0c4ed0b4

SHA512
adf4dcdc420cba0bdf86d038361e0fb643ccda8099fb79abac0c0b68d6a95cd11f32f169d58cb39e9700b48d10aa70502216fa7bd8c2765a8c86812909eebd22

Download Submit
C:\Program Files (x86)\slusat\suffaling\nerabotaert.life

Filesize
65B

MD5
64ae0715e0770708dcf1ebc677ced690

SHA1
e2c51aa34d8e771bd9555c9484b940411af77744

SHA256
1b7a9316e9319e5a14b488159b0a41b81d838e0546ae1767da85ca5f533acf23

SHA512
5537a48eb41657252757cee21b51477a2b1e15e066f4cba090c87f7de8293297f9944be0859ecf20e41733bf5d4f3d994d35ab2594c5ab7e09e826d5cbb1495e

Download Submit
C:\Program Files (x86)\slusat\suffaling\podkluchidruga.bat

Filesize
4KB

MD5
e09982b4f7254a0a5a906cbacfc7b976

SHA1
8e0717e4993d6cbb67bb77b0ce0cb9b033d6cf33

SHA256
4c8e0924e9d424a4f82da2dba694e6ce00405f99876100be76a4fbc6dfe9479e

SHA512
a0bff8820a5f39b98fdfa03f8b0e1e6bb05bc50a4ef7671e0ee80b5afc4e7e5b912da5da038627d808a1850c89320009982664988a9468baa77fd0ffd3e91c04

Download Submit
C:\Program Files (x86)\slusat\suffaling\sitbaby.vbs

Filesize
360B

MD5
6ee75ac07365c99a117a2f947003a19a

SHA1
09ef4f1a459faa8be9f3995688c32587c2b45392

SHA256
14be2b44e68f3463c783d0bbb83e8468a5967b64711592c5c6ca51b60533febc

SHA512
f9a897fa1a07958ccc594a065809cea8068ee837244d4415696e0c76e393c4394aefa6b4ebbf56184ee9a6433d29b9b673108ffe018cf871840c743784e8f15d

Download Submit
C:\Program Files (x86)\slusat\suffaling\slonik.pokakal

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
0021c993f6e270022b22a1f77f6797c1

SHA1
8f0081a7735307c166ec3a995716dd5306723410

SHA256
47195bd86b55e24282ce44af1889353c2ec9aafe4897757759ec05d263fa5dad

SHA512
d65404624973d9e2fa8a16511ad0a1ab5a0f232a6ba74e84f69e3443496ea6a580f538cbcd7f160993315b4cfa40897dc548d70ff61f01a0b81a1437e09b5fd6

Download Submit
memory/1964-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing