6866189f373528717b9fba8d1a9759ddc226efa8ffb6943bca209c2948eea085

General

Target

PHOTO-GOLAYA.exe
Size

180KB
MD5

0807cdca2c7e165f7b0a11e4c9c1e782
SHA1

8e0238ff51d78cdbaf8df22983f98a60e5600ac9
SHA256

39e6435fa4030a9252678a3fb31b7a76dddd85e1a1dcfb5446fe0907a8918dc2
SHA512

1ebaf822e01e7f19f0af134cbedfc8d738f36f0fc89419bf0c46ff0d2002aafdd314074f42f0dbdaa67a92614ff1438480087958c4e9c6dc5e553bf8c98a5f2d
SSDEEP

3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hkflw/doa/kW1uTJ:zbXE9OiTGfhEClq9FfqoacWETJ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
33	700	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	PHOTO-GOLAYA.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\nasri_v_moi_rot.govno	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs	PHOTO-GOLAYA.exe
File opened for modification	C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs	PHOTO-GOLAYA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	PHOTO-GOLAYA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1696	4572	PHOTO-GOLAYA.exe	92
PID 4572 wrote to memory of 1696	4572	PHOTO-GOLAYA.exe	92
PID 4572 wrote to memory of 1696	4572	PHOTO-GOLAYA.exe	92
PID 4572 wrote to memory of 4208	4572	PHOTO-GOLAYA.exe	94
PID 4572 wrote to memory of 4208	4572	PHOTO-GOLAYA.exe	94
PID 4572 wrote to memory of 4208	4572	PHOTO-GOLAYA.exe	94
PID 4572 wrote to memory of 700	4572	PHOTO-GOLAYA.exe	95
PID 4572 wrote to memory of 700	4572	PHOTO-GOLAYA.exe	95
PID 4572 wrote to memory of 700	4572	PHOTO-GOLAYA.exe	95

C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat" "
  2⤵
  - Drops file in Drivers directory
  PID:1696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:4208
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs"
  2⤵
  - Blocklisted process makes network request
  PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat

Filesize
2KB

MD5
61b3668ac2643b49bb2062a5888b215f

SHA1
05f2d46b1f48f61410d94b7a5d09441eebdf7197

SHA256
a8e032c00b36d3d96bb8e83b0f51ebd80bcaf76b18fbeb965e200afef7951fa8

SHA512
ae1e3b87573ecb4b3e234b2ef91d18aa0436a28bc8c76056b70f2d03266e08430b1abdcd45038cbc945553141bf05c976050055556abda798682b8c9f8e68401

Download Submit
C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs

Filesize
958B

MD5
7807a81232744da4d631a3fcb8434c87

SHA1
2571c7723d57acd1d626d43d4cc7e869f0e062f1

SHA256
605964e767c3d79df7077e7529961ad53768b285302c4756f7e78676f5edcdf2

SHA512
2ba2ab2bdb4d66d2b95fc2a741f2e55a130ec97235ea0c200fb98fdb1a54193437778eecc58a0a790efb5384255ca9095ecce6a306afb3cabf4111726e7feaa8

Download Submit
C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\nasri_v_moi_rot.govno

Filesize
33B

MD5
7d94f52916ecca6d3c68eb13ab68a2ab

SHA1
f40da9aa43d2208ab2ca0c0792572588b5f54c02

SHA256
354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a

SHA512
c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c

Download Submit
C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs

Filesize
701B

MD5
418848d826afad54d50ab0e4a1e2f750

SHA1
bc5d9717e420d21124184abbd96fb3d76da9ba07

SHA256
b9e388632f526a07145de6ba772aae8c71c2db5ef6a76e3cf21d120918d45d6c

SHA512
ad7b4a60a9bf0078b014f8821b021a653638f7f04b3b8b56548e284cbec2b245cf0f6fb75ddf84afd4e68ff950c1d19921cdd909b8153ea4943d45aadfd02744

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
c0805e6fff9d30c65b91bc9284beac8e

SHA1
45456e27d6632159ed7e4403caa1a16721c3b603

SHA256
53f25ec3705be321e5d7c17acc6ea1aba6aae01e99223f97d97bcf288c5a8228

SHA512
34648a026528d9746f73d01f7600bf947fdee00ddf8525cb89338ebd9b51789f968a79b4c1671eeb96ac83f21788167980835cae8c0f86a550ff95bddfa3c2c3

Download Submit
memory/4572-39-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing