6f148c6250ad001542a1a5fe3933b672cfc2a1eca993f156a2e4c9075abf2e39

General

Target

PHOTO-GOLAYA.exe
Size

149KB
MD5

f017add0319b24def517032c3b93b06f
SHA1

69aa7ec014e3cab55ef2f4df20e70d6856e76927
SHA256

1fccd0adbb781ba2f3c9dd5340069470ea79410cb57d8d206b29dd011dd5e46e
SHA512

9cc4a05e4b253f3f285154b82fc8945a1e00a3607feacbd20973480732a6fed210987ce42e32d24f74d582775f1ca045774054f3e4aae5c7b9ca5d41e2950d9c
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiY9ruInWRewlt:AbXE9OiTGfhEClq98PWRewlt

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	4888	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	PHOTO-GOLAYA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\koollapsa.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\slonik.po	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.pp	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hhhh.txt	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\all2.vbs	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	PHOTO-GOLAYA.exe
File created	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	PHOTO-GOLAYA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3732	4832	PHOTO-GOLAYA.exe	91
PID 4832 wrote to memory of 3732	4832	PHOTO-GOLAYA.exe	91
PID 4832 wrote to memory of 3732	4832	PHOTO-GOLAYA.exe	91
PID 3732 wrote to memory of 4888	3732	cmd.exe	93
PID 3732 wrote to memory of 4888	3732	cmd.exe	93
PID 3732 wrote to memory of 4888	3732	cmd.exe	93
PID 4832 wrote to memory of 4164	4832	PHOTO-GOLAYA.exe	94
PID 4832 wrote to memory of 4164	4832	PHOTO-GOLAYA.exe	94
PID 4832 wrote to memory of 4164	4832	PHOTO-GOLAYA.exe	94

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:4888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\al99999.vbs

Filesize
243B

MD5
23ef2c7e99fa7dea7ec005939ef9fda2

SHA1
7e283eb07d4c16c6d156b2eeeae96e02c432f7b7

SHA256
a542c80852ffe78e295d49720db744b464649f7ae4f7d8f8b9bd73b5fb085cf8

SHA512
55d41334eb10032d05bdfe0789ad0654630b8db0a31adeec10ba6ee881d0ecc95d023d1414a7b82fa1a03e9b6703ac5999439c909bd1193e30b62d28dc3359a5

Download Submit
C:\Program Files (x86)\Company\NewProduct\all2.vbs

Filesize
722B

MD5
d8bde056ff79ebdf405042460d71f823

SHA1
798dcc1ab1fa00dfa622daffd32d9c93c5bb68e9

SHA256
9cd6ea229816f42d86f0fc4373d4db66b9fb863957c0d6ff185b5537f6f9416a

SHA512
657cfd8ff737fe7a203b4f7b1e1d47569ee2ba0aaf306a8eceec8fc83e773662f85a02ae250fe34386675ee766287129da471a66131f3ffe8b29f0cdf98feee8

Download Submit
C:\Program Files (x86)\Company\NewProduct\hhhh.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

Filesize
2KB

MD5
4bef9ea6d5abdcf2238181e5e99a00a3

SHA1
9f56b3419ffc31be534965dccebc7e17cff86209

SHA256
2b34b1d6a58969a6a952fb79af1ff1462507cd4c377c610b19f29803c93c724b

SHA512
c020899846cc8d2977d886df8d369686087bf9b7db5e2e2897506a3d8f23179642b73852a46a824f9fa2fdb87f98a5c41f488d1041df7310779dd0158ee47cec

Download Submit
C:\Program Files (x86)\Company\NewProduct\slonik.po

Filesize
52B

MD5
338036b941523ede7d75fb976b9fae0d

SHA1
9c9811337a6aeb90330d3c63de45d5f083b1f4e5

SHA256
2b372c716cacdac185842371da59c1899660584647c627961ff86cf75dcdcce1

SHA512
c028e06623ec1be9f3d139952cb386b40031fb0b744f88917df6d1a8cc08d0234f38fd90b23c23d5b657ab0143265ab7d1025d102ea402f3ccb746623c635f5e

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
d9a93296f8c62ab96271667c72d7a3b3

SHA1
abcf5a6ed773cfc978fc2176138778ad406c188a

SHA256
f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993

SHA512
f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02

Download Submit
memory/4832-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing