7145589a650b5ca5c63f4f7096bc7759ccb15137581f2514533fe40d5c848b79

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PHOTO-GOLAYA.exe
Size

239KB
MD5

5ddfe645d3cbe2590b34e5afa2deb822
SHA1

df310df675c59e8958aef6ce041e78118696ad5e
SHA256

b13c0037e3ac532d246bd13e0e096509fd2fe9fa688de1bea39596368fa3341a
SHA512

ccd3706dcd7dba5543187ef6375d34eee6a07807046386f7ab0540583a9f583f583bcd7157f2c756dbb0c08f399c65aca20652ee698378d2e255cd41ce7e4ed4
SSDEEP

3072:cBAp5XhKpN4eOyVTGfhEClj8jTk+0h1Rqsrf6XFfuoyTNwTJSFya+Cgw5CKHG:LbXE9OiTGfhEClq9+6btJJUG

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.ini	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\lap_lap-kol_pois_oaloa.fok	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.gggog	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\10101010101010101010101010100101010101011010.la	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1820	2672	PHOTO-GOLAYA.exe	18
PID 2672 wrote to memory of 1820	2672	PHOTO-GOLAYA.exe	18
PID 2672 wrote to memory of 1820	2672	PHOTO-GOLAYA.exe	18
PID 2672 wrote to memory of 1820	2672	PHOTO-GOLAYA.exe	18
PID 2672 wrote to memory of 2740	2672	PHOTO-GOLAYA.exe	17
PID 2672 wrote to memory of 2740	2672	PHOTO-GOLAYA.exe	17
PID 2672 wrote to memory of 2740	2672	PHOTO-GOLAYA.exe	17
PID 2672 wrote to memory of 2740	2672	PHOTO-GOLAYA.exe	17

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\loksjin serdchema\nedorosti samim\skolidbfwbfngpxvbbo3ignbglsnflhlsbsvgkblebrhbkfb.vbs"
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\loksjin serdchema\nedorosti samim\put_ya_flower_to_unita.bat

Filesize
1KB

MD5
fcec908830aee9c8482588062b200acf

SHA1
c1a8454c1129790c36bc6e8a609c17b613284ef9

SHA256
259516df31d69f03603aa8065ecd4fdcf4eb76df9104caf04f275f41c05f9a5b

SHA512
e4561f1dfb572ad5024c3142d9b0e31447f7eb4fe0d34561927d58a4bea1fa5f5a9dd5558a713410d660c52e0ea2a2d772b89697a196d0f8eafc69b5f8c3844f

Download Submit
memory/2672-44-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2672-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download