Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5041d46dffe2971fc9377a75559258d7d964ea6237c08f836ac19b22a9f88195
-
Size
100KB
-
Sample
221002-2qecqaeaa2
-
MD5
7a71cf51fd849ec846a8ee5d9ecb2690
-
SHA1
0fb684203f2bc9d30560fd3f11d116280a2f57a9
-
SHA256
5041d46dffe2971fc9377a75559258d7d964ea6237c08f836ac19b22a9f88195
-
SHA512
2918d27902f9103c804b42a7ed3a5d88d1052e758dafa35cb74dacc654d6dd7be7d54dab20dd86de2422f3724004cefcca5d00697992f6169621c388014acad1
-
SSDEEP
3072:v47excGxFLPkH9SnbZDaPvYSUreKkeJuH9ng:v+eGYtPk0Z+ISUrR7og
Static task
static1
Behavioral task
behavioral1
Sample
PHOTO-GOLAYA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PHOTO-GOLAYA.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
PHOTO-GOLAYA.exe
-
Size
151KB
-
MD5
355645a5b17f05e83ec34aa3c92cf1c7
-
SHA1
86be5fc81cbf6608cf7c0562aab214b502bea423
-
SHA256
9b8bbfcbfe7fbe04408a11bb671dad69906cd95a2a89a94c3d2acaa62823a15c
-
SHA512
c184a409860a7acf1d35053ac14bab142adb465312196c7f47e40f3c86c3db167ee6d899b2b1626fd7af38abedf5361531e9c4f11e59a4dd0ceb137cfe0e623b
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiwgaHTeflTeJuH9nT:AbXE9OiTGfhEClq9agaza0oT
Score8/10-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-