Analysis
-
max time kernel
93s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 19:36
General
-
Target
PHOTO-GOLAYA.exe
-
Size
239KB
-
MD5
3b6a823d2a38f447bfa16008f5c1486c
-
SHA1
a73038f71665e91fcbcbf2d7c34b7601dd88d805
-
SHA256
216e9686036f1f962f05526b583ed2b26f6666e8a3783e8f42883c4a09e8f86a
-
SHA512
a65c311f7c54db12c8cd738259df95afdf2dc01d19f21c61c3e3ef410c079df1af5475fe62cb73f01dab625b09b52b358315ac62899388dc6e9e6f101ed38f53
-
SSDEEP
3072:MBAp5XhKpN4eOyVTGfhEClj8jTk+0hYoO/MgjqEWBr+Cgw5CKH6:7bXE9OiTGfhEClq95/MghJJU6
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"C:\Users\Admin\AppData\Local\Temp\PHOTO-GOLAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\lop\piccoloucioamepiacanutella\Dogma.bat" "2⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\lop\piccoloucioamepiacanutella\olologggg.vbs"2⤵
- Drops file in Drivers directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b952f2d824197f7c2c349d7cb7020669
SHA1c3af4829b1d7dd1e600fea969912cdf6d6d05c7b
SHA256eb0aad309aa85490ea3fd69b553732d65f6639c21df20d06f04ca56296be18ca
SHA5129332cbfda80fb45002e5ac90f847310a1168b234931cd491f5fb479f952484644acd272f893ec02a5772d4fb345649a59f7528537183f9ee05b12356d0877c4e
-
Filesize
92B
MD5119d851aca579cb6d3b3f996209ae746
SHA18269aa49847598efea40cd76a43846238da6c791
SHA2564f8c85a7fc4aaf52afc6fb758ea289640c8dc03d38557b12d5ed92d2c8d9005d
SHA512244b4535f9af527324977c3cd744912fb56b3946d2a1c3188725ae10753eccc969ed9b3f602b9c13e1e8df268290d7d38a1304213043e79ee2258ccb90ed25fc
-
Filesize
628B
MD53b007c1b75cc2e976187ad8387b31b8a
SHA1f34230fbb690026536ead92ab51fb97fa4f90f00
SHA2564cbc257c9ee854c9ea8c39f2d021db2ceea44fb2adee64fcaf7596cb2e03f04b
SHA512b9d23a4eceeb124f7be3cad975f013344a04656788f7a2ceb160a9e0268631029f963595b5522b7fb6865c74c2b0cdd45652bc2234329eba7f46dafe051e33c8
-
Filesize
185B
MD5b6ca24e2cc23d2c4ab76cff73b6705b9
SHA1028560ec53255c570a99884061443285f363a9ab
SHA256dc7ff1cd3688a4332b64cdc31beb07bb3de9e1b578433aae8e1b296aee4385db
SHA5124ec8a185eb1d7fdf2a6d9d6a59750338649a899ced69097bf494443652ddc8e8177f4b4de7af60d459251cd3ebca6e417164a46388096424ab96c21b39182e26
-
Filesize
1KB
MD5435d5b9ac8adeb9d27fad84bf5303c6b
SHA1bde744ec28854dae3189115a948db25c2e21a886
SHA2568c2c870afff5c4585252a9bc7675674b5756f316bb2bd0d63c09ee07972ea411
SHA5124460ee340753053374c72342d5f0878fc30a1f10d4cbde5b55440932479ab35d42487af08a27703dcf06dedf875b25ec9a888974f8adeee3243afd2f9425cb8e
-
Filesize
200KB