Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-RUSSKAYA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
GOLAYA-RUSSKAYA.exe
Resource
win10v2004-20220812-en
General
-
Target
GOLAYA-RUSSKAYA.exe
-
Size
149KB
-
MD5
45948515abac612ef6990c8afb6a2fc8
-
SHA1
e945d0b8e6e33477dfbca2c18f5517554945f21f
-
SHA256
5d9cf712292390a61de64ba8549352013e69aaf497555483afedb5b14454c387
-
SHA512
d55ff0944f80342fa81aaff2c243e6a8271ab01ea02b91354277a774bc2a94a3a2f5a0aaede1bf5bcaf0e075b01bab557525098803a5fe4fbfb43ed56ec0b724
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hio1mLMF7Dpn:AbXE9OiTGfhEClq9u1YMF7D1
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 1804 WScript.exe 4 1804 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.pp GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\all2.vbs GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\slonik.po GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\hhhh.txt GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\koollapsa.bat GOLAYA-RUSSKAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1324 1388 GOLAYA-RUSSKAYA.exe 26 PID 1388 wrote to memory of 1324 1388 GOLAYA-RUSSKAYA.exe 26 PID 1388 wrote to memory of 1324 1388 GOLAYA-RUSSKAYA.exe 26 PID 1388 wrote to memory of 1324 1388 GOLAYA-RUSSKAYA.exe 26 PID 1324 wrote to memory of 1804 1324 cmd.exe 28 PID 1324 wrote to memory of 1804 1324 cmd.exe 28 PID 1324 wrote to memory of 1804 1324 cmd.exe 28 PID 1324 wrote to memory of 1804 1324 cmd.exe 28 PID 1388 wrote to memory of 1620 1388 GOLAYA-RUSSKAYA.exe 29 PID 1388 wrote to memory of 1620 1388 GOLAYA-RUSSKAYA.exe 29 PID 1388 wrote to memory of 1620 1388 GOLAYA-RUSSKAYA.exe 29 PID 1388 wrote to memory of 1620 1388 GOLAYA-RUSSKAYA.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "2⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"3⤵
- Blocklisted process makes network request
PID:1804
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"2⤵
- Drops file in Drivers directory
PID:1620
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258B
MD54f13c561e8c1a666e912afefd7cf758d
SHA19cfd5e512bbc2be7ed670f85a731d97a83c71077
SHA256ebb4b61362f29913fab27388fbd70963155333eee1cb4e94110730c82d4eab40
SHA512e7395661df1e81db2575900162112020dd5b6e82debb1e9c419c4399bab92d1ddbb50d0f33f9df54716c7c9398e86013cdfac82f4c2ed0e7e756f068679f3d54
-
Filesize
258B
MD54f13c561e8c1a666e912afefd7cf758d
SHA19cfd5e512bbc2be7ed670f85a731d97a83c71077
SHA256ebb4b61362f29913fab27388fbd70963155333eee1cb4e94110730c82d4eab40
SHA512e7395661df1e81db2575900162112020dd5b6e82debb1e9c419c4399bab92d1ddbb50d0f33f9df54716c7c9398e86013cdfac82f4c2ed0e7e756f068679f3d54
-
Filesize
703B
MD52d6ea08436f0586e48170422bab7c38a
SHA137c85b8e2fa65881ee79703fc24ef6116d0e9ad1
SHA256a119e8db9020bc3e9a540dae375bfb2ab3b136714544d6d765f7dc9c31448dce
SHA512e00428d180204fc258c137fcb8b65226ed3eda7f3f488f8194a1b58f0babc2b9e0d694492e376f819eaca70c79f09925ee86f26307e32f10924693e4bab33a01
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
2KB
MD572aa207e9713c3869aab3ee8d4d16813
SHA16276deeebee93166a2f075ead56cb8532a378d7e
SHA256474a48dcca705150ee9342fc8a076f4ec684d1e50240f5b0c7823500e622240f
SHA512e2697f2effd036a7c24f57c957118b98eb6797be356ee34739e655ed0dfe4d637fc68e288e8c146f2f03af3adfda50d8a57ae44666fa5fe8034d3b3e3c064192
-
Filesize
53B
MD57c0760920e021c6d0bd65f24885a9486
SHA1e4e218108e76e6b0db2655b666e203969d1cfede
SHA256c1bf0846f0baac6aeace4f9c42e62c349304d0ebc0a97dc435758cb07ad96aa1
SHA5125f1cfd3454a1127106c1a1756b72f99a9a6dc5137a3a9f922b0f0111890cebdc1f6b90613e1246780762ed68f7578881726316467a45e198b491626c4c4cc686
-
Filesize
1KB
MD50021c993f6e270022b22a1f77f6797c1
SHA18f0081a7735307c166ec3a995716dd5306723410
SHA25647195bd86b55e24282ce44af1889353c2ec9aafe4897757759ec05d263fa5dad
SHA512d65404624973d9e2fa8a16511ad0a1ab5a0f232a6ba74e84f69e3443496ea6a580f538cbcd7f160993315b4cfa40897dc548d70ff61f01a0b81a1437e09b5fd6