Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

GOLAYA-PHOTO.exe

windows7-x64

8

GOLAYA-PHOTO.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eeb0439037506477d91224150323ed9eb3bbc4a8314d82e51842437d53cb1a75

  • Size

    111KB

  • Sample

    221203-a43hxsaf32

  • MD5

    2846742608bda3e4f18509bca006dbd3

  • SHA1

    ea109bb29185ede3d04206a3094e0783b1f4ab1f

  • SHA256

    eeb0439037506477d91224150323ed9eb3bbc4a8314d82e51842437d53cb1a75

  • SHA512

    82b855bbb50efa3d50dd81869e953e81443983e75f95acd928249b07b507a91c46eb597c66caba55f85b7a3f73bbfa61c0ec18967feca4af4e0c3e352de33206

  • SSDEEP

    3072:Il0img13tG90HdQ3Sqt9YacAHRmpuf32KAj4S9vf:IljpD9Q3Tt9Sp4ovf

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-PHOTO.exe

    • Size

      239KB

    • MD5

      9932b8424ae1bc1663264d490bddf2ac

    • SHA1

      7d0ae571d6b5d549d81e8490d9345caae621b912

    • SHA256

      83cbcd25b74ebb00e5bee3d97b1152469d662b35e224f892b5456bbf7d529196

    • SHA512

      070214beaccada100d55d83b11cb7c749a509c9b95a781828acef32bf76ac06fe6382b8020c258d5ca750be6fb0548f826bf4d925cd3604f80d9f8b7624f5c9c

    • SSDEEP

      3072:XBAp5XhKpN4eOyVTGfhEClj8jTk+0hgd5rY4J9UqztfJ4t0873l8ACHxDgeTmzgA:abXE9OiTGfhEClq9Td5roJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks