986211af8206aca6ce7df334278765c02bf93ea9fd36cca6ad7c96ac84db3dc8

General

Target

PHOTO-GOLAYA.exe
Size

239KB
MD5

9932b8424ae1bc1663264d490bddf2ac
SHA1

7d0ae571d6b5d549d81e8490d9345caae621b912
SHA256

83cbcd25b74ebb00e5bee3d97b1152469d662b35e224f892b5456bbf7d529196
SHA512

070214beaccada100d55d83b11cb7c749a509c9b95a781828acef32bf76ac06fe6382b8020c258d5ca750be6fb0548f826bf4d925cd3604f80d9f8b7624f5c9c
SSDEEP

3072:XBAp5XhKpN4eOyVTGfhEClj8jTk+0hgd5rY4J9UqztfJ4t0873l8ACHxDgeTmzgA:abXE9OiTGfhEClq9Td5roJJUK

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	1280	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	PHOTO-GOLAYA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\opasdkjsadflijsldf.wf	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\Uninstall.ini	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro	PHOTO-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	PHOTO-GOLAYA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4796	2440	PHOTO-GOLAYA.exe	80
PID 2440 wrote to memory of 4796	2440	PHOTO-GOLAYA.exe	80
PID 2440 wrote to memory of 4796	2440	PHOTO-GOLAYA.exe	80
PID 2440 wrote to memory of 1280	2440	PHOTO-GOLAYA.exe	82
PID 2440 wrote to memory of 1280	2440	PHOTO-GOLAYA.exe	82
PID 2440 wrote to memory of 1280	2440	PHOTO-GOLAYA.exe	82

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:4796
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\froggi_nogcci.bat

Filesize
1KB

MD5
20853446d43d601e884d7075b57f4b63

SHA1
79c0818ab6ae170750f0f4af86204882fb2a6a9a

SHA256
63f8bda3226e4ba720fc5bd20e9366de87e061fff5dc7c4f6684967389b4cc28

SHA512
a7d1d135a398236443b57b8796744dcce94fa074119d215a70d1bdaeb03600dc3d6241fc6abe672582cc6eec94517d4a6b25e76d70121c0e1a76ca8c63234784

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.tua

Filesize
1KB

MD5
69e4efbdf60b45d582ac88a553f7da92

SHA1
ebb520d168bae3d2e3c350c356b8f874c6e9f7b9

SHA256
e6adb4107227482a38f376cab8710e11ef7125874e4481c548e98ee5df94ff63

SHA512
627d736393d36b6f7a7c348a7f467f7a258adb4bf33b7e38528f1a9222e6bc8f08eb0c21f3eab320249cb29a61013b9e916a09df902c61f2d455665603100b50

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\netu_pokoya_mne_gore.vbs

Filesize
1KB

MD5
69e4efbdf60b45d582ac88a553f7da92

SHA1
ebb520d168bae3d2e3c350c356b8f874c6e9f7b9

SHA256
e6adb4107227482a38f376cab8710e11ef7125874e4481c548e98ee5df94ff63

SHA512
627d736393d36b6f7a7c348a7f467f7a258adb4bf33b7e38528f1a9222e6bc8f08eb0c21f3eab320249cb29a61013b9e916a09df902c61f2d455665603100b50

Download Submit
C:\Program Files (x86)\oni_voobshe_ohueli_haher\yarko_zeltie_vot_eto_da_bleat\pod_yasnim_nebom_yanvarya.pro

Filesize
106B

MD5
74305d205702e48e96da6265224b456f

SHA1
387686c3598b5d9bb084f1597aeb3c1687b8b001

SHA256
afc5e57f3536cc17c46c377efe3746f80079b1917597bb3430298ddb570a3faf

SHA512
67fb29190052df27d2a5166a9de5233b64037aac5d00cb31c986850bfcb91f6df8927aa76140dcb126cd8f82eb8dc6c5aaef87816ec5505f176ff62286fafdf0

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
f2c5d10ad27bb489a71a16e71b70e8b4

SHA1
5154928e4445092cedd422c549817c7a50e59d76

SHA256
e085c03394954c9b369c0a6f8704062b3c6ab932208fe6061e7a5a5bac851428

SHA512
2f01c24aa2cc579b5d77c13a6b2af9f76738f7868c30a665ea0a4759d80032fbb451a1bbf406554223898a3c2ca586d4749a10b445823f28ef0585acbe57edf9

Download Submit
memory/1280-136-0x0000000000000000-mapping.dmp

Download
memory/4796-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing