07ddef481f055e1de8a70f40aab0db42646260ed49100bd13c9398376568e300

General

Target
PHOTO-GOLAYA.exe
Size 150KB
Sample221206-akpgysah79
SHA256 dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea
MD5 13064a1549e859958c07462c9b2f0a58
SHA1 da6a8be2da028023ad9a350845eae67a64b5bf7e
SHA512 f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533
SSDEEP 3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
68	1336	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	PHOTO-GOLAYA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.ini	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\dus_dezodorant\mouyus\90909090.ico	PHOTO-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	PHOTO-GOLAYA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3740	3788	PHOTO-GOLAYA.exe	80
PID 3788 wrote to memory of 3740	3788	PHOTO-GOLAYA.exe	80
PID 3788 wrote to memory of 3740	3788	PHOTO-GOLAYA.exe	80
PID 3740 wrote to memory of 1336	3740	cmd.exe	82
PID 3740 wrote to memory of 1336	3740	cmd.exe	82
PID 3740 wrote to memory of 1336	3740	cmd.exe	82
PID 3788 wrote to memory of 4924	3788	PHOTO-GOLAYA.exe	83
PID 3788 wrote to memory of 4924	3788	PHOTO-GOLAYA.exe	83
PID 3788 wrote to memory of 4924	3788	PHOTO-GOLAYA.exe	83

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1336
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drochka_peredrochka.vbs

Path C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs
Size 789B
SHA256 22dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d
MD5 fbfaf5456d9016723c58958bbb6fcb99
SHA1 38d0c30b1d89f76a0471f528d6f3536061661a9b
SHA512 537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6
MD5 SHA1 SHA512

Submit Download

fifa.vbs

Path C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs
Size 316B
SHA256 f8bcebb93f79463e73675bb1f611debda612e5d48237092aed4604f1da837e69
MD5 9a6686649e0ccb189c6122695cb7acb3
SHA1 925042488d9b06013ee5c1c8372a7980d335fab3
SHA512 173b08167eff99101732f6b08f7111e1d6c1c998bc9794a93530857cf49183bd651340a592360c2a75b259ee83118b63c25732f01342bb5ada96467dc2e4eed6
MD5 SHA1 SHA512

Submit Download

readme.txt

Path C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt
Size 39B
SHA256 c0c37efa00039b77e1b72d650ef0622c65db937771617ee3f0e3adf7f480360c
MD5 8cdff5761878e3cf771aea2aa10c1a4e
SHA1 8f7c0e2f1642ae768f3f2f9a45992a1f57c26aba
SHA512 730c5dd152d8f7a48f5bcda68f10b7f64235938b106479b8340fc3bbe4cfde113219deef03ca7726bcd7c9dfbcd12e4f53c631b20a77a51644ae1c1bc10e0ab4
MD5 SHA1 SHA512

Submit Download

tutunas.nistyak

Path C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak
Size 27B
SHA256 9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
MD5 213c0742081a9007c9093a01760f9f8c
SHA1 df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA512 55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
MD5 SHA1 SHA512

Submit Download

zelands.bat

Path C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat
Size 3KB
SHA256 fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863
MD5 25a0b02e83ef7cc0e50772e9ca8fdbe9
SHA1 5bf8d941645128fc22548c44d1cb9f64b0cfb360
SHA512 b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 1KB
SHA256 47195bd86b55e24282ce44af1889353c2ec9aafe4897757759ec05d263fa5dad
MD5 0021c993f6e270022b22a1f77f6797c1
SHA1 8f0081a7735307c166ec3a995716dd5306723410
SHA512 d65404624973d9e2fa8a16511ad0a1ab5a0f232a6ba74e84f69e3443496ea6a580f538cbcd7f160993315b4cfa40897dc548d70ff61f01a0b81a1437e09b5fd6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads