a8b7d7095a254b454a4cebad995896ec4476e8f1d9677a12be97fd15c696d389

Analysis

max time kernel
71s
max time network
80s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PHOTO-GOLAYA.exe
Size

180KB
MD5

731790f96390935dcf6c9451c7b80c68
SHA1

92e152be11147d807725aa55aea4825675f654f5
SHA256

58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
SHA512

76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
SSDEEP

3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	936	WScript.exe
5	936	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs	PHOTO-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1152	1480	PHOTO-GOLAYA.exe	27
PID 1480 wrote to memory of 1152	1480	PHOTO-GOLAYA.exe	27
PID 1480 wrote to memory of 1152	1480	PHOTO-GOLAYA.exe	27
PID 1480 wrote to memory of 1152	1480	PHOTO-GOLAYA.exe	27
PID 1480 wrote to memory of 936	1480	PHOTO-GOLAYA.exe	29
PID 1480 wrote to memory of 936	1480	PHOTO-GOLAYA.exe	29
PID 1480 wrote to memory of 936	1480	PHOTO-GOLAYA.exe	29
PID 1480 wrote to memory of 936	1480	PHOTO-GOLAYA.exe	29

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1152
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat

Filesize
2KB

MD5
e9e0099ccb581f1525d1326cefdb4073

SHA1
40518edb8268b660429ef1ce579fc475d07d9505

SHA256
eb5d1d8c0626e0ae30bf00ba808d80c9567ca1e3c490ed71ad5879f0e1e3e7be

SHA512
d99f2d0b72b9aeab70b981415cb84f16505ada62e135b4e0d2dacedb8bc015606fe9f2990815f76d447e675d59fd8fbe8510055c19cc4269d64dff7e685411c5

Download Submit
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs

Filesize
961B

MD5
c655a1056d38e2fb59e945dd99da06fc

SHA1
3a8f9d68b2a940afcde3bb94fb00e1196adc156c

SHA256
db3ebf6bef77cfcf0b49ccec0808939e153bfb78a4abd335285fd9952c80e027

SHA512
cca2d216c48a96123d3f83ff9002b00ee4d0752d1757b2afb43440fba244d8591f6653496dc1070ee4785f6328de8643ef83f0b5982dbe7b626ba7bf5d0c113f

Download Submit
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu

Filesize
74B

MD5
be2441081cb9a4ed63f6a72e32b05463

SHA1
3b04bd3642c215e4f5bc8607331503c0452136d3

SHA256
8f076a419ac552f474d7823f4c8236cc27708a567ef67e25061fe158da053d34

SHA512
5089406a58077b5baa51f5f896858cb2098625c8ebcff050571557d4f1905b8c443533f92d605226d52a956ff30c0e526afdfdbc2c0ddca635026618358fba26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
c103de0bdd559496de273a00bd9b6806

SHA1
7da2e899d8d1c6110495602364375fb800012e21

SHA256
9351acf3b7ab24de41196bef296b951acb91338c428a4da92f3885ecdd19c1f0

SHA512
6548f7499649c5fd6324379f348e4e5a9df1b0cd103609d3453c901e4d10e70ebc182cef131a75dd53cc73a15ebfe1e36cde4005e488879900d552da5511eb19

Download Submit
memory/936-57-0x0000000000000000-mapping.dmp

Download
memory/1152-55-0x0000000000000000-mapping.dmp

Download
memory/1480-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download