8bd69f694a6a714f54e44051168c0a2d105c758cf3adaa9f322bf17ffb1a3667

Analysis

max time kernel
330s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-DEVOCHKA.exe
Size

180KB
MD5

731790f96390935dcf6c9451c7b80c68
SHA1

92e152be11147d807725aa55aea4825675f654f5
SHA256

58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
SHA512

76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
SSDEEP

3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1428	3896	GOLAYA-DEVOCHKA.exe	85
PID 3896 wrote to memory of 1428	3896	GOLAYA-DEVOCHKA.exe	85
PID 3896 wrote to memory of 1428	3896	GOLAYA-DEVOCHKA.exe	85

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat

Filesize
2KB

MD5
e9e0099ccb581f1525d1326cefdb4073

SHA1
40518edb8268b660429ef1ce579fc475d07d9505

SHA256
eb5d1d8c0626e0ae30bf00ba808d80c9567ca1e3c490ed71ad5879f0e1e3e7be

SHA512
d99f2d0b72b9aeab70b981415cb84f16505ada62e135b4e0d2dacedb8bc015606fe9f2990815f76d447e675d59fd8fbe8510055c19cc4269d64dff7e685411c5

Download Submit