e12629b9daae409309854fdb14c78e9e9d6b022512c7d5cbd0c323dd26b972e7

Analysis

max time kernel
0s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-PHOTO.exe
Size

149KB
MD5

bb56c5bb89c3b94f370473b957aece84
SHA1

4139ddb92122333d61e57c97cbd75a91bd8a42ed
SHA256

b3928bb091873840a406cb0f0c3f5f35fb8c04d729b407672c498f6a78e74f8c
SHA512

ff6a55323b554e88d96d3ac29c9e0187f295af7c7065a2bf20b5fe494bdb3068f422142631bc39b24e4174957095e99afffa162065740934f17d94c6cab1a374
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiztfVOO0krXu:AbXE9OiTGfhEClq9pf76

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	GOLAYA-PHOTO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Produc\New\samisok.vbs	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nadopilitsa.nabazu	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\Produc\New\Uninstall.exe	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\Produc\New\Uninstall.ini	GOLAYA-PHOTO.exe
File created	C:\Program Files (x86)\Produc\New\nadopilitsa.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Produc\New\poppets.txt	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nevedomaya.hernya	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nuashks.bat	GOLAYA-PHOTO.exe
File opened for modification	C:\Program Files (x86)\Produc\New\nadopilitsa.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4768	2216	GOLAYA-PHOTO.exe	95
PID 2216 wrote to memory of 4768	2216	GOLAYA-PHOTO.exe	95
PID 2216 wrote to memory of 4768	2216	GOLAYA-PHOTO.exe	95

C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-PHOTO.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Produc\New\samisok.vbs"
  2⤵
  PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Produc\New\nuashks.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:4768

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Produc\New\nadopilitsa.vbs"
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Produc\New\nadopilitsa.vbs

Filesize
234B

MD5
6c86f55825faf8d78c73a75593532b62

SHA1
b588b22149a5ea676e748637b5273df66874df94

SHA256
f0f5980f257615ea251f33cec0bb508210a348348b5384b9c72c969e26f854ec

SHA512
8f55b699454ac573d72c2488c39fd4935f569438929651afbfe911c8302fd2a9e29036a655118aa272d6e9664734c23b605ff61e440640c2cd9474c4373b6ef2

Download Submit
C:\Program Files (x86)\Produc\New\nuashks.bat

Filesize
3KB

MD5
5344c1ee5d19842f875b732e28d78df5

SHA1
3d6dd120c45c4e2c7da6e73d0d2a2bf44ab62c08

SHA256
4f444d593d36894b9f31ac5d34ed0da77dd193caeb08e59c6e0b9697a0404d05

SHA512
82eec69b768350757f6a1ad72b62d0ec800f90ddb8d264de06b8e3ba3c3eb7875acbd7d69f52e646fff4f6e1de42d47630379a6eec3984415a7446410bd998c1

Download Submit
C:\Program Files (x86)\Produc\New\poppets.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Produc\New\samisok.vbs

Filesize
766B

MD5
d75b4ac2afa8da8d78931cb84e36f6b9

SHA1
5d17b6aace7772f0ea3a2abcf404267180460dd0

SHA256
fbdcd852e988e5356e979c673aa93b363c182545aadf03d02dcba556bacfaf43

SHA512
df5df025b16b1bce547f0ae3f5694e8856b68c2df3009cc6e96ce386fc263dd7a5c189f76baa386b825192fbf901a33ae2aec77f8ba17a1e8b029fe96cbf7f7c

Download Submit
memory/2216-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download