Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4a9e3a6fed463095102434f29319b1b_JaffaCakes118

  • Size

    89KB

  • Sample

    240417-avwc9agf48

  • MD5

    f4a9e3a6fed463095102434f29319b1b

  • SHA1

    b567fd475c36fbcec99e296aa583ce034b0e3aac

  • SHA256

    530323b4295661c7524d65d4fd64ad33bec3c0e42269bb55d6cfc77baaa99dfe

  • SHA512

    70a4dc3a5de19475212ff0cf18dc405998ea7c5f2b9f0b0c08dfe252d7ae5bcc7d4c51895697a73a5c996b028385b80727989f0973d81a636a05f16b28d3e868

  • SSDEEP

    1536:/UnVN5HOHUEs6iqcuyIJ4fnb07w3317NbesR3SRXAlO+aSPVTtHvsGiKl0:/UnLYCq/Fufnb07YPe8CJADDNtkRKG

Score
8/10

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      180KB

    • MD5

      956e2b490c56f641e1ec22001a6c8390

    • SHA1

      4cc154694540b69f848c6508996c964981f1c6dc

    • SHA256

      4b6a3c6b886086fbe58630f2742813b2fe79bf89b047551ddd9560a5f40839e8

    • SHA512

      03c3b0e411f5f77f4164e1070884bb60b7a8e7948f142c2ddf574aac6178643522f8ab2ec221e8dd6dd243ff98129e6a9f8446a4dbec92dbe01c7da67c6714d0

    • SSDEEP

      3072:rBAp5XhKpN4eOyVTGfhEClj8jTk+0hR4udk4RjbC5:WbXE9OiTGfhEClq9Xuvjb4

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks