046d475ec0346f6de53624e04c62bd2dd88447c846baed6bf9eec85c6d6f5fba

General

Target

GOLAYA-SEXY.exe
Size

239KB
MD5

cc3e79604fed1f63c7f5f24916fd1d51
SHA1

08872ad23e2e9e897d30506d783ed15f4491a25b
SHA256

d74b26bea7fd5d0206c63b5251569a57c889debb2cac8e5ad8908a658b8fcd2a
SHA512

22c20dc56f46e44e522eac57ded0da8b571e6da2fd37f083509846bb557e513081daddd4d7d9d6cce86d7216ffdfb4ac6e4311e2259dca956d1af5253630e547
SSDEEP

3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0hijkEDboYxU044U/13+Cgw5CKHy:HbXE9OiTGfhEClq9YEXoyDjUEJJUy

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow	pid	Process
3	2556	WScript.exe
5	2556	WScript.exe

Drops file in Drivers directory 3 IoCs

Processes:

cmd.exeWScript.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

Processes:

GOLAYA-SEXY.execmd.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.ini	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\nu kak bi vsua hernya.fos	GOLAYA-SEXY.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\Uninstall.exe	GOLAYA-SEXY.exe
File created	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross	GOLAYA-SEXY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

GOLAYA-SEXY.exe

description	pid	Process	procid_target
PID 1708 wrote to memory of 2864	1708	GOLAYA-SEXY.exe	28
PID 1708 wrote to memory of 2864	1708	GOLAYA-SEXY.exe	28
PID 1708 wrote to memory of 2864	1708	GOLAYA-SEXY.exe	28
PID 1708 wrote to memory of 2864	1708	GOLAYA-SEXY.exe	28
PID 1708 wrote to memory of 2556	1708	GOLAYA-SEXY.exe	30
PID 1708 wrote to memory of 2556	1708	GOLAYA-SEXY.exe	30
PID 1708 wrote to memory of 2556	1708	GOLAYA-SEXY.exe	30
PID 1708 wrote to memory of 2556	1708	GOLAYA-SEXY.exe	30

C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat" "
  2⤵
  - Drops file in Drivers directory
  - Drops file in Program Files directory
  PID:2864
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.vbs"
  2⤵
  - Blocklisted process makes network request
  - Drops file in Drivers directory
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\slooooowthespeedafer.cross

Filesize
1KB

MD5
64ad61d0535f2f16d2e0898f5becc6d7

SHA1
d019ae5edf589cec0812c3d703f75dfeefd0a2ce

SHA256
1ccbc7d478e6ec655aa960addeec99037913565f905bf0edf02694cb27a2229c

SHA512
e31ed889d87bf036fa80341f2fdb3086ea5b150693343fa422db225c2d136e11a761cf801bf384c2d10c7635c8fb03be88025cd9af455c222298ab44bf3afb46

Download Submit
C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\svezee_techenie_cheloveko.bat

Filesize
1KB

MD5
6daad30db16dca2393e95dc79993b935

SHA1
539786a8fc9d50a02c4d0299a88ce7c09ed414c1

SHA256
97c36a9e98886b271bd479fde0f384b75ef04399ebd1554d2490966d56d385d9

SHA512
ed9d7b8b3d14fc2136dd28788874446559f388e591c20d7e2e343a5a1d96bc1af46e6586da0a78ad0bcd15c9a170aad9d37c4b0dd840298b117b51ab7dac22a8

Download Submit
C:\Program Files (x86)\tokom kak neer delat\ne glad ego kisto4koi\xranilise_vsei_figni_tut.bok

Filesize
99B

MD5
86dc7199339e9623d9cb19240a752740

SHA1
71cb2333efd767a21c031c23bb5b7e81115aff18

SHA256
c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

SHA512
eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
07747e26ea3ffd06b1e9825864be253c

SHA1
97b8ae03f2a4835ba0cef297bd1582aa2eebb983

SHA256
13e54f2ba2925d259803f92c44c26c3b1739f6340087475159bb140eed3a2f32

SHA512
619747f33df62d66437c874ba60ed33c8a178127ea763388b816bf7b3e332e94c612f6360fd23e008256c73b70b4660278578c2758ad09ae544e10736f8d6b8d

Download Submit
memory/1708-44-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1708-48-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads