Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    211e225322255d65872aee72c54be373

  • Size

    86KB

  • Sample

    231225-qjjhbaagh6

  • MD5

    211e225322255d65872aee72c54be373

  • SHA1

    cf770cb1cc3ed691c67e4defd80beee64d6702fc

  • SHA256

    f8a08db300bfa0c7a001dfcc3e17b3d6baaaf5d0b66b7e5e47597ecbb5211bc7

  • SHA512

    f3daa918ab2edaffdc67c3498c34b4374f855923c935c1bb82ac97ec3dd5d6e85e3daebcc0fcd5c58c47b4e3496196af45e9365dc6f813e6d1c553e059b008ad

  • SSDEEP

    1536:pQwHfvMS0xcGxFyhQkrnb1Mq9WbYdpA+UD5Xb+xzzlgVrOre4pUi8OgfRR:pnHXMpxcGxFyhQ0bOqYM7TU5b+dp2rCa

Score
8/10

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      180KB

    • MD5

      36811975c8783184baa4c6b52e9ef020

    • SHA1

      d58d15a044498dd031c0dbd0df2d1b11dda68375

    • SHA256

      676e6244d7bb1fe69ab533cbad20f3c0cc57f951041d81d91e445fd726ff57f6

    • SHA512

      c9777f95b32240bb8bec608e28e4cbbea4a40233b5409ef6bd508b5f91df8bfd512315db54c642a4807fed0c38ee629f704a10b0d1aea2499a0092c7db381cd9

    • SSDEEP

      3072:NBAp5XhKpN4eOyVTGfhEClj8jTk+0hfAWFmEeQqqqqqqqqo/9:IbXE9OiTGfhEClq9K9Q

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks