5d53983b22ced76ff56dd83a6b0799750d5f5069ac7e83ab4562214f4968905c

General

Target

PHOTO-DEVOCHKA.exe
Size

149KB
MD5

13135ec7bee7db877b3654059374ebde
SHA1

f3f3a8c6b395211ebdbb2a73769e21c401d34e0c
SHA256

7dbe9bdea098a5cb0608135c1705d2aa2e080ebc4146a02001a793ff0970252a
SHA512

3f7eb418322b1abbe60b2fa6845ffb3e530808739b0dc542707c713f83bc4b02a4a1568a28e9badeb71bd5512e14a47387abe80b2edf0b440f2c40cc3cc08db8
SSDEEP

3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiqtAhp:AbXE9OiTGfhEClq9QtAhp

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	1900	WScript.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	PHOTO-DEVOCHKA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.pp	PHOTO-DEVOCHKA.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	PHOTO-DEVOCHKA.exe
File created	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\slonik.po	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\all2.vbs	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\koollapsa.bat	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	PHOTO-DEVOCHKA.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\al99999.vbs	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\hhhh.txt	PHOTO-DEVOCHKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	PHOTO-DEVOCHKA.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2448	2828	PHOTO-DEVOCHKA.exe	90
PID 2828 wrote to memory of 2448	2828	PHOTO-DEVOCHKA.exe	90
PID 2828 wrote to memory of 2448	2828	PHOTO-DEVOCHKA.exe	90
PID 2448 wrote to memory of 1900	2448	cmd.exe	92
PID 2448 wrote to memory of 1900	2448	cmd.exe	92
PID 2448 wrote to memory of 1900	2448	cmd.exe	92
PID 2828 wrote to memory of 1704	2828	PHOTO-DEVOCHKA.exe	93
PID 2828 wrote to memory of 1704	2828	PHOTO-DEVOCHKA.exe	93
PID 2828 wrote to memory of 1704	2828	PHOTO-DEVOCHKA.exe	93

C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe
"C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1900
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
  2⤵
  - Drops file in Drivers directory
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\al99999.pp

Filesize
234B

MD5
0ed4d363b23de2f2e155f12a2caad6c6

SHA1
ca01261735a2368e29c3b2695e0156a447099aa2

SHA256
0832d445cecf5f174085cb2209c073f83c5ddc48c95d8d1642eaba37c2ab5567

SHA512
7d889d3be545c1aff88db384923d88aa229fbd66540dae0b788e12ed58573e4b3f7c52c2d5db18343fc3a33382b6e169c2cca7233778700da1df5cd16d055e4f

Download Submit
C:\Program Files (x86)\Company\NewProduct\all2.vbs

Filesize
678B

MD5
bf72f45eb64682832ec502a1d3d2fe36

SHA1
a77c4751b9a679c0b31c1d854dffaf0d2886d4ab

SHA256
c2efdbb412e438c9d74954778935676013f4485bf16d8076b23c191a3f81fa05

SHA512
438832c895db8d26dcbfb9ac3575d4f6478649c871ca9c52b588cec751a5eb6ad187c5f00a0b6d150205036a306e4ab8000a1f16a54cfb7d783b4492a1be0407

Download Submit
C:\Program Files (x86)\Company\NewProduct\hhhh.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

Filesize
3KB

MD5
2180c017ea68ff374d8a37aea32f6b8d

SHA1
bdc5a525249a41e434cba309e79b8eac0aeb6865

SHA256
e541a4b41252542251096f388810d4ec2d0e1f1e96f222134982d95581abd3a1

SHA512
a70d00862535e055fc7283d367921f1f037ea1fce71b57bdd74463f00428eb2dd5b8006cb61ce882e586cce8825c620f202498ceaaa8d727cf16a5d4aef29aca

Download Submit
C:\Program Files (x86)\Company\NewProduct\slonik.po

Filesize
65B

MD5
ad13b5db4d7ddfa3f5239e5b5f06e8e5

SHA1
24c28d82adacac1b118f5d1abbc12218583431e9

SHA256
7dc870d6e2fb495c37409b887f79e02d74bdd6bef3ba45a8ac8a3003d33ae73e

SHA512
4b71633dcf9f5ad986cc09c22da7956a7b006563df4e752cc9d3507743c4c3dc55a309a68fe17ef8a0c6779ae694dd55b7f61c4b3638cf8806722a6fbdf8af03

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
d9a93296f8c62ab96271667c72d7a3b3

SHA1
abcf5a6ed773cfc978fc2176138778ad406c188a

SHA256
f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993

SHA512
f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02

Download Submit
memory/2828-3-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2828-28-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2828-59-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing