031b3ab03bf6172e80c32a413ea75f89846fc0def222bc8c21e47299ab6aa33a

Analysis

max time kernel
185s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-DEVOCHKA.exe
Size

180KB
MD5

731790f96390935dcf6c9451c7b80c68
SHA1

92e152be11147d807725aa55aea4825675f654f5
SHA256

58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
SHA512

76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
SSDEEP

3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
59	3348	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	GOLAYA-DEVOCHKA.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat	GOLAYA-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs	GOLAYA-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	GOLAYA-DEVOCHKA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3276	3664	GOLAYA-DEVOCHKA.exe	93
PID 3664 wrote to memory of 3276	3664	GOLAYA-DEVOCHKA.exe	93
PID 3664 wrote to memory of 3276	3664	GOLAYA-DEVOCHKA.exe	93
PID 3664 wrote to memory of 3348	3664	GOLAYA-DEVOCHKA.exe	95
PID 3664 wrote to memory of 3348	3664	GOLAYA-DEVOCHKA.exe	95
PID 3664 wrote to memory of 3348	3664	GOLAYA-DEVOCHKA.exe	95

C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:3276
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat

Filesize
2KB

MD5
e9e0099ccb581f1525d1326cefdb4073

SHA1
40518edb8268b660429ef1ce579fc475d07d9505

SHA256
eb5d1d8c0626e0ae30bf00ba808d80c9567ca1e3c490ed71ad5879f0e1e3e7be

SHA512
d99f2d0b72b9aeab70b981415cb84f16505ada62e135b4e0d2dacedb8bc015606fe9f2990815f76d447e675d59fd8fbe8510055c19cc4269d64dff7e685411c5

Download Submit
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs

Filesize
961B

MD5
c655a1056d38e2fb59e945dd99da06fc

SHA1
3a8f9d68b2a940afcde3bb94fb00e1196adc156c

SHA256
db3ebf6bef77cfcf0b49ccec0808939e153bfb78a4abd335285fd9952c80e027

SHA512
cca2d216c48a96123d3f83ff9002b00ee4d0752d1757b2afb43440fba244d8591f6653496dc1070ee4785f6328de8643ef83f0b5982dbe7b626ba7bf5d0c113f

Download Submit
C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu

Filesize
74B

MD5
be2441081cb9a4ed63f6a72e32b05463

SHA1
3b04bd3642c215e4f5bc8607331503c0452136d3

SHA256
8f076a419ac552f474d7823f4c8236cc27708a567ef67e25061fe158da053d34

SHA512
5089406a58077b5baa51f5f896858cb2098625c8ebcff050571557d4f1905b8c443533f92d605226d52a956ff30c0e526afdfdbc2c0ddca635026618358fba26

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
c0805e6fff9d30c65b91bc9284beac8e

SHA1
45456e27d6632159ed7e4403caa1a16721c3b603

SHA256
53f25ec3705be321e5d7c17acc6ea1aba6aae01e99223f97d97bcf288c5a8228

SHA512
34648a026528d9746f73d01f7600bf947fdee00ddf8525cb89338ebd9b51789f968a79b4c1671eeb96ac83f21788167980835cae8c0f86a550ff95bddfa3c2c3

Download Submit
memory/3664-16-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3664-46-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download