6f148c6250ad001542a1a5fe3933b672cfc2a1eca993f156a2e4c9075abf2e39

General

Target

PHOTO-GOLAYA.exe
Size

149KB
MD5

f017add0319b24def517032c3b93b06f
SHA1

69aa7ec014e3cab55ef2f4df20e70d6856e76927
SHA256

1fccd0adbb781ba2f3c9dd5340069470ea79410cb57d8d206b29dd011dd5e46e
SHA512

9cc4a05e4b253f3f285154b82fc8945a1e00a3607feacbd20973480732a6fed210987ce42e32d24f74d582775f1ca045774054f3e4aae5c7b9ca5d41e2950d9c
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiY9ruInWRewlt:AbXE9OiTGfhEClq98PWRewlt

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2956	WScript.exe
5	2956	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hhhh.txt	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\koollapsa.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\all2.vbs	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\slonik.po	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.pp	PHOTO-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2792	2708	PHOTO-GOLAYA.exe	29
PID 2708 wrote to memory of 2792	2708	PHOTO-GOLAYA.exe	29
PID 2708 wrote to memory of 2792	2708	PHOTO-GOLAYA.exe	29
PID 2708 wrote to memory of 2792	2708	PHOTO-GOLAYA.exe	29
PID 2792 wrote to memory of 2956	2792	cmd.exe	31
PID 2792 wrote to memory of 2956	2792	cmd.exe	31
PID 2792 wrote to memory of 2956	2792	cmd.exe	31
PID 2792 wrote to memory of 2956	2792	cmd.exe	31
PID 2708 wrote to memory of 2120	2708	PHOTO-GOLAYA.exe	32
PID 2708 wrote to memory of 2120	2708	PHOTO-GOLAYA.exe	32
PID 2708 wrote to memory of 2120	2708	PHOTO-GOLAYA.exe	32
PID 2708 wrote to memory of 2120	2708	PHOTO-GOLAYA.exe	32

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:2956
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\al99999.pp

Filesize
243B

MD5
23ef2c7e99fa7dea7ec005939ef9fda2

SHA1
7e283eb07d4c16c6d156b2eeeae96e02c432f7b7

SHA256
a542c80852ffe78e295d49720db744b464649f7ae4f7d8f8b9bd73b5fb085cf8

SHA512
55d41334eb10032d05bdfe0789ad0654630b8db0a31adeec10ba6ee881d0ecc95d023d1414a7b82fa1a03e9b6703ac5999439c909bd1193e30b62d28dc3359a5

Download Submit
C:\Program Files (x86)\Company\NewProduct\all2.vbs

Filesize
722B

MD5
d8bde056ff79ebdf405042460d71f823

SHA1
798dcc1ab1fa00dfa622daffd32d9c93c5bb68e9

SHA256
9cd6ea229816f42d86f0fc4373d4db66b9fb863957c0d6ff185b5537f6f9416a

SHA512
657cfd8ff737fe7a203b4f7b1e1d47569ee2ba0aaf306a8eceec8fc83e773662f85a02ae250fe34386675ee766287129da471a66131f3ffe8b29f0cdf98feee8

Download Submit
C:\Program Files (x86)\Company\NewProduct\hhhh.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

Filesize
2KB

MD5
4bef9ea6d5abdcf2238181e5e99a00a3

SHA1
9f56b3419ffc31be534965dccebc7e17cff86209

SHA256
2b34b1d6a58969a6a952fb79af1ff1462507cd4c377c610b19f29803c93c724b

SHA512
c020899846cc8d2977d886df8d369686087bf9b7db5e2e2897506a3d8f23179642b73852a46a824f9fa2fdb87f98a5c41f488d1041df7310779dd0158ee47cec

Download Submit
C:\Program Files (x86)\Company\NewProduct\slonik.po

Filesize
52B

MD5
338036b941523ede7d75fb976b9fae0d

SHA1
9c9811337a6aeb90330d3c63de45d5f083b1f4e5

SHA256
2b372c716cacdac185842371da59c1899660584647c627961ff86cf75dcdcce1

SHA512
c028e06623ec1be9f3d139952cb386b40031fb0b744f88917df6d1a8cc08d0234f38fd90b23c23d5b657ab0143265ab7d1025d102ea402f3ccb746623c635f5e

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
44ccd2e0f82c735fbef30c341d6bfc10

SHA1
8cc305f7f8fff401380175ae0cc7d0df99b83373

SHA256
d29b19381fbf3494195232c63a36e6a9d38de4e2db3e80ae3f007a36e9674db3

SHA512
8627b9c13415f5d9c917692281f2a33aa4286f0a50b0d08933ca663cd6cc12fb17256a2270ff283dd497661001b6c06f3d16e889215821659fa24ede367dfe07

Download Submit
memory/2708-74-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing