Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
PHOTO-GOLAYA.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
PHOTO-GOLAYA.exe
Resource
win10v2004-20231215-en
General
-
Target
PHOTO-GOLAYA.exe
-
Size
149KB
-
MD5
f017add0319b24def517032c3b93b06f
-
SHA1
69aa7ec014e3cab55ef2f4df20e70d6856e76927
-
SHA256
1fccd0adbb781ba2f3c9dd5340069470ea79410cb57d8d206b29dd011dd5e46e
-
SHA512
9cc4a05e4b253f3f285154b82fc8945a1e00a3607feacbd20973480732a6fed210987ce42e32d24f74d582775f1ca045774054f3e4aae5c7b9ca5d41e2950d9c
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiY9ruInWRewlt:AbXE9OiTGfhEClq98PWRewlt
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 16 4888 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation PHOTO-GOLAYA.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\koollapsa.bat PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\slonik.po PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.pp PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\hhhh.txt PHOTO-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\all2.vbs PHOTO-GOLAYA.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini PHOTO-GOLAYA.exe File created C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings PHOTO-GOLAYA.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4832 wrote to memory of 3732 4832 PHOTO-GOLAYA.exe 91 PID 4832 wrote to memory of 3732 4832 PHOTO-GOLAYA.exe 91 PID 4832 wrote to memory of 3732 4832 PHOTO-GOLAYA.exe 91 PID 3732 wrote to memory of 4888 3732 cmd.exe 93 PID 3732 wrote to memory of 4888 3732 cmd.exe 93 PID 3732 wrote to memory of 4888 3732 cmd.exe 93 PID 4832 wrote to memory of 4164 4832 PHOTO-GOLAYA.exe 94 PID 4832 wrote to memory of 4164 4832 PHOTO-GOLAYA.exe 94 PID 4832 wrote to memory of 4164 4832 PHOTO-GOLAYA.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"3⤵
- Blocklisted process makes network request
PID:4888
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"2⤵
- Drops file in Drivers directory
PID:4164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243B
MD523ef2c7e99fa7dea7ec005939ef9fda2
SHA17e283eb07d4c16c6d156b2eeeae96e02c432f7b7
SHA256a542c80852ffe78e295d49720db744b464649f7ae4f7d8f8b9bd73b5fb085cf8
SHA51255d41334eb10032d05bdfe0789ad0654630b8db0a31adeec10ba6ee881d0ecc95d023d1414a7b82fa1a03e9b6703ac5999439c909bd1193e30b62d28dc3359a5
-
Filesize
722B
MD5d8bde056ff79ebdf405042460d71f823
SHA1798dcc1ab1fa00dfa622daffd32d9c93c5bb68e9
SHA2569cd6ea229816f42d86f0fc4373d4db66b9fb863957c0d6ff185b5537f6f9416a
SHA512657cfd8ff737fe7a203b4f7b1e1d47569ee2ba0aaf306a8eceec8fc83e773662f85a02ae250fe34386675ee766287129da471a66131f3ffe8b29f0cdf98feee8
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
2KB
MD54bef9ea6d5abdcf2238181e5e99a00a3
SHA19f56b3419ffc31be534965dccebc7e17cff86209
SHA2562b34b1d6a58969a6a952fb79af1ff1462507cd4c377c610b19f29803c93c724b
SHA512c020899846cc8d2977d886df8d369686087bf9b7db5e2e2897506a3d8f23179642b73852a46a824f9fa2fdb87f98a5c41f488d1041df7310779dd0158ee47cec
-
Filesize
52B
MD5338036b941523ede7d75fb976b9fae0d
SHA19c9811337a6aeb90330d3c63de45d5f083b1f4e5
SHA2562b372c716cacdac185842371da59c1899660584647c627961ff86cf75dcdcce1
SHA512c028e06623ec1be9f3d139952cb386b40031fb0b744f88917df6d1a8cc08d0234f38fd90b23c23d5b657ab0143265ab7d1025d102ea402f3ccb746623c635f5e
-
Filesize
1KB
MD5d9a93296f8c62ab96271667c72d7a3b3
SHA1abcf5a6ed773cfc978fc2176138778ad406c188a
SHA256f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993
SHA512f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02