Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 18:10

General

  • Target

    GOLAYA-RUSSKAYA.exe

  • Size

    149KB

  • MD5

    45948515abac612ef6990c8afb6a2fc8

  • SHA1

    e945d0b8e6e33477dfbca2c18f5517554945f21f

  • SHA256

    5d9cf712292390a61de64ba8549352013e69aaf497555483afedb5b14454c387

  • SHA512

    d55ff0944f80342fa81aaff2c243e6a8271ab01ea02b91354277a774bc2a94a3a2f5a0aaede1bf5bcaf0e075b01bab557525098803a5fe4fbfb43ed56ec0b724

  • SSDEEP

    3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hio1mLMF7Dpn:AbXE9OiTGfhEClq9u1YMF7D1

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"
        3⤵
        • Blocklisted process makes network request
        PID:1804
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"
      2⤵
      • Drops file in Drivers directory
      PID:1620

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Company\NewProduct\al99999.pp

    Filesize

    258B

    MD5

    4f13c561e8c1a666e912afefd7cf758d

    SHA1

    9cfd5e512bbc2be7ed670f85a731d97a83c71077

    SHA256

    ebb4b61362f29913fab27388fbd70963155333eee1cb4e94110730c82d4eab40

    SHA512

    e7395661df1e81db2575900162112020dd5b6e82debb1e9c419c4399bab92d1ddbb50d0f33f9df54716c7c9398e86013cdfac82f4c2ed0e7e756f068679f3d54

  • C:\Program Files (x86)\Company\NewProduct\al99999.vbs

    Filesize

    258B

    MD5

    4f13c561e8c1a666e912afefd7cf758d

    SHA1

    9cfd5e512bbc2be7ed670f85a731d97a83c71077

    SHA256

    ebb4b61362f29913fab27388fbd70963155333eee1cb4e94110730c82d4eab40

    SHA512

    e7395661df1e81db2575900162112020dd5b6e82debb1e9c419c4399bab92d1ddbb50d0f33f9df54716c7c9398e86013cdfac82f4c2ed0e7e756f068679f3d54

  • C:\Program Files (x86)\Company\NewProduct\all2.vbs

    Filesize

    703B

    MD5

    2d6ea08436f0586e48170422bab7c38a

    SHA1

    37c85b8e2fa65881ee79703fc24ef6116d0e9ad1

    SHA256

    a119e8db9020bc3e9a540dae375bfb2ab3b136714544d6d765f7dc9c31448dce

    SHA512

    e00428d180204fc258c137fcb8b65226ed3eda7f3f488f8194a1b58f0babc2b9e0d694492e376f819eaca70c79f09925ee86f26307e32f10924693e4bab33a01

  • C:\Program Files (x86)\Company\NewProduct\hhhh.txt

    Filesize

    27B

    MD5

    213c0742081a9007c9093a01760f9f8c

    SHA1

    df53bb518c732df777b5ce19fc7c02dcb2f9d81b

    SHA256

    9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

    SHA512

    55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

  • C:\Program Files (x86)\Company\NewProduct\koollapsa.bat

    Filesize

    2KB

    MD5

    72aa207e9713c3869aab3ee8d4d16813

    SHA1

    6276deeebee93166a2f075ead56cb8532a378d7e

    SHA256

    474a48dcca705150ee9342fc8a076f4ec684d1e50240f5b0c7823500e622240f

    SHA512

    e2697f2effd036a7c24f57c957118b98eb6797be356ee34739e655ed0dfe4d637fc68e288e8c146f2f03af3adfda50d8a57ae44666fa5fe8034d3b3e3c064192

  • C:\Program Files (x86)\Company\NewProduct\slonik.po

    Filesize

    53B

    MD5

    7c0760920e021c6d0bd65f24885a9486

    SHA1

    e4e218108e76e6b0db2655b666e203969d1cfede

    SHA256

    c1bf0846f0baac6aeace4f9c42e62c349304d0ebc0a97dc435758cb07ad96aa1

    SHA512

    5f1cfd3454a1127106c1a1756b72f99a9a6dc5137a3a9f922b0f0111890cebdc1f6b90613e1246780762ed68f7578881726316467a45e198b491626c4c4cc686

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    0021c993f6e270022b22a1f77f6797c1

    SHA1

    8f0081a7735307c166ec3a995716dd5306723410

    SHA256

    47195bd86b55e24282ce44af1889353c2ec9aafe4897757759ec05d263fa5dad

    SHA512

    d65404624973d9e2fa8a16511ad0a1ab5a0f232a6ba74e84f69e3443496ea6a580f538cbcd7f160993315b4cfa40897dc548d70ff61f01a0b81a1437e09b5fd6

  • memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

    Filesize

    8KB