da23410b814f148edc43845651a0f8c0b3ee4fd19f5f048319aed84b4411a36e

General

Target

GOLAYA-RUSSKAYA.exe
Size

150KB
MD5

4cc42c8dc48f61f0c412ca91e4f57fd5
SHA1

d132a8d93af350d331348103ebce31564e57ad2e
SHA256

0d0e2cafa773aab31a1e8b965222b3dcbb831c447da8ffdf959c7c0f50443f01
SHA512

a9e2342c4b56807540f4103c44d281883048ae004f32592c9aa65bc0495847f07f15d11e73be6733a56d68a5b24b876cb45396b9779945abe98eba79f57b209e
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiewyyhqar4FG1dgcjS:AbXE9OiTGfhEClq9pxrkGXi

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	4444	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	GOLAYA-RUSSKAYA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\domashku\zry\ogorodiki.vbs	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\ya_ne_lublu_ne_nitie_be_bluz.fff	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\novaya_h.uita	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\alena_lubit.bat	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\kak_stik.stoit	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\ovos.vbs	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\Uninstall.exe	GOLAYA-RUSSKAYA.exe
File created	C:\Program Files (x86)\domashku\zry\Uninstall.ini	GOLAYA-RUSSKAYA.exe
File opened for modification	C:\Program Files (x86)\domashku\zry\gggg.ico	GOLAYA-RUSSKAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	GOLAYA-RUSSKAYA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 3556	1588	GOLAYA-RUSSKAYA.exe	83
PID 1588 wrote to memory of 3556	1588	GOLAYA-RUSSKAYA.exe	83
PID 1588 wrote to memory of 3556	1588	GOLAYA-RUSSKAYA.exe	83
PID 3556 wrote to memory of 4444	3556	cmd.exe	85
PID 3556 wrote to memory of 4444	3556	cmd.exe	85
PID 3556 wrote to memory of 4444	3556	cmd.exe	85
PID 1588 wrote to memory of 4876	1588	GOLAYA-RUSSKAYA.exe	86
PID 1588 wrote to memory of 4876	1588	GOLAYA-RUSSKAYA.exe	86
PID 1588 wrote to memory of 4876	1588	GOLAYA-RUSSKAYA.exe	86

C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\domashku\zry\alena_lubit.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ovos.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:4444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ogorodiki.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\domashku\zry\alena_lubit.bat

Filesize
4KB

MD5
c4cd7942ad95c077849d8231bde0f937

SHA1
7b3a6bd3de1bb44dd1f37259bfbb06718178898f

SHA256
cd98d22c97784cdf5f0a3c9072b24d44ec940dfbe39c1dc870736ee8a5d1da12

SHA512
e466b7a4524895819c5a66e2c89a80d6cdcf84a4efa8f9a490b9beffc772c70fe3df90d814c96a657e04889456ead2718f3c4108ed7eb323c1f0fb63ab64fcca

Download Submit
C:\Program Files (x86)\domashku\zry\kak_stik.stoit

Filesize
48B

MD5
9987c41b3d35914e43ad601f189430ae

SHA1
92c8e10f3f9b0c1efccd0607d243c08a589632e0

SHA256
88513acac6366f0f015026f14a6f8b538a96c956e17e0629e96c16fa09d92d52

SHA512
4e7b6c8ef7dcb16ca069b89b17bacc455b5b8cc9501879d7edfac45c47c415798279fc54920b9aa1dc91b5773c689e038c8774719e8f8035ab11d3c69b1809ea

Download Submit
C:\Program Files (x86)\domashku\zry\novaya_h.uita

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\domashku\zry\ogorodiki.vbs

Filesize
864B

MD5
986daebc65c26626d11af120fcbaa879

SHA1
c49d6d0ff106eac240eff401f5f3094840d6fcb7

SHA256
881874274351c56c0cd00b22f989b83c029c61661334ab2aaa6e44e5b0f3ce36

SHA512
22f0f5de23fc5fb3b33e12783b046f1a92931f79cc49f419d15cdc6815c832880aec2ec1d727ec4311f7f32a72dbc6eb4a337d9f84836d8a7b379502ea0dd905

Download Submit
C:\Program Files (x86)\domashku\zry\ovos.vbs

Filesize
437B

MD5
6e07c890e39a589c087bb68024d94a4d

SHA1
cf55319c07fc90820e4b496bf5d2e748c325a577

SHA256
184e571af696b3ce89cc4c6c7a9c00147e09c58562551f43e08f4fe8e9fdd545

SHA512
f2981c021c154e5cd7d5e7ca3192232cc01bd560488536ae24aeda5e8803360a050efa2b2d505102cbd8cd3aab786e2983ee5de6549a249d41c571c8fa0ae74d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
6ab0366c27f08185c0d4375c02596855

SHA1
f9ff3458ec4b5b5aa94eec1e3a212a7921b50478

SHA256
489480a2f0aeed456ab09a8953471d49f76c8466867e28b86c69b70335cf28ee

SHA512
3a24a6e43d5888e1fccfdf55378b05cd4dc73678dff0cb053d6e7c71616877fb19fd1e71c11da1da6a48d0fa64b7c28ff544bf7ab1a7f71c49858cadc7088ec4

Download Submit

Analysis

Sharing