Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 20:25 UTC

General

  • Target

    GOLAYA-RUSSKAYA.exe

  • Size

    150KB

  • MD5

    4cc42c8dc48f61f0c412ca91e4f57fd5

  • SHA1

    d132a8d93af350d331348103ebce31564e57ad2e

  • SHA256

    0d0e2cafa773aab31a1e8b965222b3dcbb831c447da8ffdf959c7c0f50443f01

  • SHA512

    a9e2342c4b56807540f4103c44d281883048ae004f32592c9aa65bc0495847f07f15d11e73be6733a56d68a5b24b876cb45396b9779945abe98eba79f57b209e

  • SSDEEP

    3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiewyyhqar4FG1dgcjS:AbXE9OiTGfhEClq9pxrkGXi

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-RUSSKAYA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\domashku\zry\alena_lubit.bat" "
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ovos.vbs"
        3⤵
        • Blocklisted process makes network request
        PID:4444
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\domashku\zry\ogorodiki.vbs"
      2⤵
      • Drops file in Drivers directory
      PID:4876

Network

    No results found
  • 64.62.191.222:4321
    WScript.exe
    260 B
    5
  • 104.208.16.90:443
    322 B
    7
  • 67.26.207.254:80
    322 B
    7
  • 67.26.207.254:80
    322 B
    7
  • 67.26.207.254:80
    322 B
    7
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\domashku\zry\alena_lubit.bat

    Filesize

    4KB

    MD5

    c4cd7942ad95c077849d8231bde0f937

    SHA1

    7b3a6bd3de1bb44dd1f37259bfbb06718178898f

    SHA256

    cd98d22c97784cdf5f0a3c9072b24d44ec940dfbe39c1dc870736ee8a5d1da12

    SHA512

    e466b7a4524895819c5a66e2c89a80d6cdcf84a4efa8f9a490b9beffc772c70fe3df90d814c96a657e04889456ead2718f3c4108ed7eb323c1f0fb63ab64fcca

  • C:\Program Files (x86)\domashku\zry\kak_stik.stoit

    Filesize

    48B

    MD5

    9987c41b3d35914e43ad601f189430ae

    SHA1

    92c8e10f3f9b0c1efccd0607d243c08a589632e0

    SHA256

    88513acac6366f0f015026f14a6f8b538a96c956e17e0629e96c16fa09d92d52

    SHA512

    4e7b6c8ef7dcb16ca069b89b17bacc455b5b8cc9501879d7edfac45c47c415798279fc54920b9aa1dc91b5773c689e038c8774719e8f8035ab11d3c69b1809ea

  • C:\Program Files (x86)\domashku\zry\novaya_h.uita

    Filesize

    27B

    MD5

    213c0742081a9007c9093a01760f9f8c

    SHA1

    df53bb518c732df777b5ce19fc7c02dcb2f9d81b

    SHA256

    9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

    SHA512

    55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

  • C:\Program Files (x86)\domashku\zry\ogorodiki.vbs

    Filesize

    864B

    MD5

    986daebc65c26626d11af120fcbaa879

    SHA1

    c49d6d0ff106eac240eff401f5f3094840d6fcb7

    SHA256

    881874274351c56c0cd00b22f989b83c029c61661334ab2aaa6e44e5b0f3ce36

    SHA512

    22f0f5de23fc5fb3b33e12783b046f1a92931f79cc49f419d15cdc6815c832880aec2ec1d727ec4311f7f32a72dbc6eb4a337d9f84836d8a7b379502ea0dd905

  • C:\Program Files (x86)\domashku\zry\ovos.vbs

    Filesize

    437B

    MD5

    6e07c890e39a589c087bb68024d94a4d

    SHA1

    cf55319c07fc90820e4b496bf5d2e748c325a577

    SHA256

    184e571af696b3ce89cc4c6c7a9c00147e09c58562551f43e08f4fe8e9fdd545

    SHA512

    f2981c021c154e5cd7d5e7ca3192232cc01bd560488536ae24aeda5e8803360a050efa2b2d505102cbd8cd3aab786e2983ee5de6549a249d41c571c8fa0ae74d

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    6ab0366c27f08185c0d4375c02596855

    SHA1

    f9ff3458ec4b5b5aa94eec1e3a212a7921b50478

    SHA256

    489480a2f0aeed456ab09a8953471d49f76c8466867e28b86c69b70335cf28ee

    SHA512

    3a24a6e43d5888e1fccfdf55378b05cd4dc73678dff0cb053d6e7c71616877fb19fd1e71c11da1da6a48d0fa64b7c28ff544bf7ab1a7f71c49858cadc7088ec4

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.