Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 20:30

General

  • Target

    GOLAYA-SEXY.exe

  • Size

    180KB

  • MD5

    69a9db2003415946eb1185c9ab4d6ca4

  • SHA1

    a4e84147d24c578a9a0ac9b4b08815d45cf035c1

  • SHA256

    39f420b486362ecca29eb4c068e665c2bd126f6f526049c26491539d1135582f

  • SHA512

    2ddd0734c50bf4ecb5be23127e1354d641d78c49d4f20c703ef36621db6af9c1dcc2447f3d04527ea9fe56cdaf425c651b932139faed62537ceee3b662c14ad8

  • SSDEEP

    3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYwYs:fbXE9OiTGfhEClq9s+mYnhIAhyT

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\ne_nu_ne_zraza_li.vbs"
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat" "
      2⤵
      • Drops file in Drivers directory
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\power inverters, radar\Tourism Whistler offers\09olbanid_go_stricktly.bat

    Filesize

    2KB

    MD5

    926497e0b7802e2be23ff2d679be6780

    SHA1

    c9506ae5a5eadcce4d8f5794f689666987178e91

    SHA256

    389d064e349b788b989b4dba96d2599b1cc3c1ea9f560b7dc8d52e27872708b4

    SHA512

    4ebdbeb8c3a142397f72a274bf7ce7af60f2bb1fca510b7ea6685f05c38cff1f92db8fc8a69166b569ed86b577462fd1ad5e64b7941fd4e42c0ba23e858317c4

  • memory/1788-42-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1788-47-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB