Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-SEXY.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
GOLAYA-SEXY.exe
Resource
win10v2004-20231215-en
General
-
Target
GOLAYA-SEXY.exe
-
Size
180KB
-
MD5
69a9db2003415946eb1185c9ab4d6ca4
-
SHA1
a4e84147d24c578a9a0ac9b4b08815d45cf035c1
-
SHA256
39f420b486362ecca29eb4c068e665c2bd126f6f526049c26491539d1135582f
-
SHA512
2ddd0734c50bf4ecb5be23127e1354d641d78c49d4f20c703ef36621db6af9c1dcc2447f3d04527ea9fe56cdaf425c651b932139faed62537ceee3b662c14ad8
-
SSDEEP
3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYwYs:fbXE9OiTGfhEClq9s+mYnhIAhyT
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2684 WScript.exe 5 2684 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\upppploooooollll.ruu GOLAYA-SEXY.exe File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat GOLAYA-SEXY.exe File opened for modification C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs GOLAYA-SEXY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2560 1788 GOLAYA-SEXY.exe 19 PID 1788 wrote to memory of 2560 1788 GOLAYA-SEXY.exe 19 PID 1788 wrote to memory of 2560 1788 GOLAYA-SEXY.exe 19 PID 1788 wrote to memory of 2560 1788 GOLAYA-SEXY.exe 19 PID 1788 wrote to memory of 2684 1788 GOLAYA-SEXY.exe 18 PID 1788 wrote to memory of 2684 1788 GOLAYA-SEXY.exe 18 PID 1788 wrote to memory of 2684 1788 GOLAYA-SEXY.exe 18 PID 1788 wrote to memory of 2684 1788 GOLAYA-SEXY.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs"2⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
PID:2684
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat" "2⤵
- Drops file in Drivers directory
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5926497e0b7802e2be23ff2d679be6780
SHA1c9506ae5a5eadcce4d8f5794f689666987178e91
SHA256389d064e349b788b989b4dba96d2599b1cc3c1ea9f560b7dc8d52e27872708b4
SHA5124ebdbeb8c3a142397f72a274bf7ce7af60f2bb1fca510b7ea6685f05c38cff1f92db8fc8a69166b569ed86b577462fd1ad5e64b7941fd4e42c0ba23e858317c4