Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 20:25 UTC
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-RUSSKAYA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
GOLAYA-RUSSKAYA.exe
Resource
win10v2004-20220901-en
General
-
Target
GOLAYA-RUSSKAYA.exe
-
Size
150KB
-
MD5
4cc42c8dc48f61f0c412ca91e4f57fd5
-
SHA1
d132a8d93af350d331348103ebce31564e57ad2e
-
SHA256
0d0e2cafa773aab31a1e8b965222b3dcbb831c447da8ffdf959c7c0f50443f01
-
SHA512
a9e2342c4b56807540f4103c44d281883048ae004f32592c9aa65bc0495847f07f15d11e73be6733a56d68a5b24b876cb45396b9779945abe98eba79f57b209e
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiewyyhqar4FG1dgcjS:AbXE9OiTGfhEClq9pxrkGXi
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 17 4444 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation GOLAYA-RUSSKAYA.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\domashku\zry\ogorodiki.vbs GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\ya_ne_lublu_ne_nitie_be_bluz.fff GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\novaya_h.uita GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\alena_lubit.bat GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\kak_stik.stoit GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\ovos.vbs GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\Uninstall.exe GOLAYA-RUSSKAYA.exe File created C:\Program Files (x86)\domashku\zry\Uninstall.ini GOLAYA-RUSSKAYA.exe File opened for modification C:\Program Files (x86)\domashku\zry\gggg.ico GOLAYA-RUSSKAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings GOLAYA-RUSSKAYA.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1588 wrote to memory of 3556 1588 GOLAYA-RUSSKAYA.exe 83 PID 1588 wrote to memory of 3556 1588 GOLAYA-RUSSKAYA.exe 83 PID 1588 wrote to memory of 3556 1588 GOLAYA-RUSSKAYA.exe 83 PID 3556 wrote to memory of 4444 3556 cmd.exe 85 PID 3556 wrote to memory of 4444 3556 cmd.exe 85 PID 3556 wrote to memory of 4444 3556 cmd.exe 85 PID 1588 wrote to memory of 4876 1588 GOLAYA-RUSSKAYA.exe 86 PID 1588 wrote to memory of 4876 1588 GOLAYA-RUSSKAYA.exe 86 PID 1588 wrote to memory of 4876 1588 GOLAYA-RUSSKAYA.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\domashku\zry\alena_lubit.bat" "2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ovos.vbs"3⤵
- Blocklisted process makes network request
PID:4444
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ogorodiki.vbs"2⤵
- Drops file in Drivers directory
PID:4876
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c4cd7942ad95c077849d8231bde0f937
SHA17b3a6bd3de1bb44dd1f37259bfbb06718178898f
SHA256cd98d22c97784cdf5f0a3c9072b24d44ec940dfbe39c1dc870736ee8a5d1da12
SHA512e466b7a4524895819c5a66e2c89a80d6cdcf84a4efa8f9a490b9beffc772c70fe3df90d814c96a657e04889456ead2718f3c4108ed7eb323c1f0fb63ab64fcca
-
Filesize
48B
MD59987c41b3d35914e43ad601f189430ae
SHA192c8e10f3f9b0c1efccd0607d243c08a589632e0
SHA25688513acac6366f0f015026f14a6f8b538a96c956e17e0629e96c16fa09d92d52
SHA5124e7b6c8ef7dcb16ca069b89b17bacc455b5b8cc9501879d7edfac45c47c415798279fc54920b9aa1dc91b5773c689e038c8774719e8f8035ab11d3c69b1809ea
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
864B
MD5986daebc65c26626d11af120fcbaa879
SHA1c49d6d0ff106eac240eff401f5f3094840d6fcb7
SHA256881874274351c56c0cd00b22f989b83c029c61661334ab2aaa6e44e5b0f3ce36
SHA51222f0f5de23fc5fb3b33e12783b046f1a92931f79cc49f419d15cdc6815c832880aec2ec1d727ec4311f7f32a72dbc6eb4a337d9f84836d8a7b379502ea0dd905
-
Filesize
437B
MD56e07c890e39a589c087bb68024d94a4d
SHA1cf55319c07fc90820e4b496bf5d2e748c325a577
SHA256184e571af696b3ce89cc4c6c7a9c00147e09c58562551f43e08f4fe8e9fdd545
SHA512f2981c021c154e5cd7d5e7ca3192232cc01bd560488536ae24aeda5e8803360a050efa2b2d505102cbd8cd3aab786e2983ee5de6549a249d41c571c8fa0ae74d
-
Filesize
1KB
MD56ab0366c27f08185c0d4375c02596855
SHA1f9ff3458ec4b5b5aa94eec1e3a212a7921b50478
SHA256489480a2f0aeed456ab09a8953471d49f76c8466867e28b86c69b70335cf28ee
SHA5123a24a6e43d5888e1fccfdf55378b05cd4dc73678dff0cb053d6e7c71616877fb19fd1e71c11da1da6a48d0fa64b7c28ff544bf7ab1a7f71c49858cadc7088ec4