bad30cacf6c1e80ea6e216eb47deb1b209f1ec1192d3c94b01b9bb97252e9866

Analysis

max time kernel
24s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GOLAYA-SEXY.exe
Size

239KB
MD5

cc3e79604fed1f63c7f5f24916fd1d51
SHA1

08872ad23e2e9e897d30506d783ed15f4491a25b
SHA256

d74b26bea7fd5d0206c63b5251569a57c889debb2cac8e5ad8908a658b8fcd2a
SHA512

22c20dc56f46e44e522eac57ded0da8b571e6da2fd37f083509846bb557e513081daddd4d7d9d6cce86d7216ffdfb4ac6e4311e2259dca956d1af5253630e547
SSDEEP

3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0hijkEDboYxU044U/13+Cgw5CKHy:HbXE9OiTGfhEClq9YEXoyDjUEJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	2708	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	GOLAYA-SEXY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.ini	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	GOLAYA-SEXY.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4404	3144	GOLAYA-SEXY.exe	27
PID 3144 wrote to memory of 4404	3144	GOLAYA-SEXY.exe	27
PID 3144 wrote to memory of 4404	3144	GOLAYA-SEXY.exe	27
PID 3144 wrote to memory of 2708	3144	GOLAYA-SEXY.exe	29
PID 3144 wrote to memory of 2708	3144	GOLAYA-SEXY.exe	29
PID 3144 wrote to memory of 2708	3144	GOLAYA-SEXY.exe	29

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:4404
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
6daad30db16dca2393e95dc79993b935

SHA1
539786a8fc9d50a02c4d0299a88ce7c09ed414c1

SHA256
97c36a9e98886b271bd479fde0f384b75ef04399ebd1554d2490966d56d385d9

SHA512
ed9d7b8b3d14fc2136dd28788874446559f388e591c20d7e2e343a5a1d96bc1af46e6586da0a78ad0bcd15c9a170aad9d37c4b0dd840298b117b51ab7dac22a8

Download Submit
memory/3144-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3144-41-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download