ffbcef7a582266076e939d47c6c00bc1b761949664811567c26e67ca5b49e6f4

Analysis

max time kernel
298s
max time network
379s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RUSSKAYA-GOLAYA.exe
Size

180KB
MD5

0807cdca2c7e165f7b0a11e4c9c1e782
SHA1

8e0238ff51d78cdbaf8df22983f98a60e5600ac9
SHA256

39e6435fa4030a9252678a3fb31b7a76dddd85e1a1dcfb5446fe0907a8918dc2
SHA512

1ebaf822e01e7f19f0af134cbedfc8d738f36f0fc89419bf0c46ff0d2002aafdd314074f42f0dbdaa67a92614ff1438480087958c4e9c6dc5e553bf8c98a5f2d
SSDEEP

3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hkflw/doa/kW1uTJ:zbXE9OiTGfhEClq9FfqoacWETJ

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	RUSSKAYA-GOLAYA.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\nasri_v_moi_rot.govno	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs	RUSSKAYA-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs	RUSSKAYA-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	RUSSKAYA-GOLAYA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2568	4672	RUSSKAYA-GOLAYA.exe	82
PID 4672 wrote to memory of 2568	4672	RUSSKAYA-GOLAYA.exe	82
PID 4672 wrote to memory of 2568	4672	RUSSKAYA-GOLAYA.exe	82
PID 4672 wrote to memory of 2592	4672	RUSSKAYA-GOLAYA.exe	84
PID 4672 wrote to memory of 2592	4672	RUSSKAYA-GOLAYA.exe	84
PID 4672 wrote to memory of 2592	4672	RUSSKAYA-GOLAYA.exe	84
PID 4672 wrote to memory of 2296	4672	RUSSKAYA-GOLAYA.exe	85
PID 4672 wrote to memory of 2296	4672	RUSSKAYA-GOLAYA.exe	85
PID 4672 wrote to memory of 2296	4672	RUSSKAYA-GOLAYA.exe	85

C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:2568
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs"
  2⤵
  PID:2592
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs"
  2⤵
  PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat

Filesize
2KB

MD5
61b3668ac2643b49bb2062a5888b215f

SHA1
05f2d46b1f48f61410d94b7a5d09441eebdf7197

SHA256
a8e032c00b36d3d96bb8e83b0f51ebd80bcaf76b18fbeb965e200afef7951fa8

SHA512
ae1e3b87573ecb4b3e234b2ef91d18aa0436a28bc8c76056b70f2d03266e08430b1abdcd45038cbc945553141bf05c976050055556abda798682b8c9f8e68401

Download Submit
memory/2296-135-0x0000000000000000-mapping.dmp

Download
memory/2568-132-0x0000000000000000-mapping.dmp

Download
memory/2592-134-0x0000000000000000-mapping.dmp

Download