Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
RUSSKAYA-GOLAYA.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RUSSKAYA-GOLAYA.exe
Resource
win10v2004-20231215-en
General
-
Target
RUSSKAYA-GOLAYA.exe
-
Size
149KB
-
MD5
45948515abac612ef6990c8afb6a2fc8
-
SHA1
e945d0b8e6e33477dfbca2c18f5517554945f21f
-
SHA256
5d9cf712292390a61de64ba8549352013e69aaf497555483afedb5b14454c387
-
SHA512
d55ff0944f80342fa81aaff2c243e6a8271ab01ea02b91354277a774bc2a94a3a2f5a0aaede1bf5bcaf0e075b01bab557525098803a5fe4fbfb43ed56ec0b724
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hio1mLMF7Dpn:AbXE9OiTGfhEClq9u1YMF7D1
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 13 4776 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation RUSSKAYA-GOLAYA.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe RUSSKAYA-GOLAYA.exe File created C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\hhhh.txt RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.pp RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\slonik.po RUSSKAYA-GOLAYA.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\al99999.vbs cmd.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\all2.vbs RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\koollapsa.bat RUSSKAYA-GOLAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings RUSSKAYA-GOLAYA.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5048 wrote to memory of 4468 5048 RUSSKAYA-GOLAYA.exe 23 PID 5048 wrote to memory of 4468 5048 RUSSKAYA-GOLAYA.exe 23 PID 5048 wrote to memory of 4468 5048 RUSSKAYA-GOLAYA.exe 23 PID 4468 wrote to memory of 4776 4468 cmd.exe 24 PID 4468 wrote to memory of 4776 4468 cmd.exe 24 PID 4468 wrote to memory of 4776 4468 cmd.exe 24 PID 5048 wrote to memory of 5040 5048 RUSSKAYA-GOLAYA.exe 25 PID 5048 wrote to memory of 5040 5048 RUSSKAYA-GOLAYA.exe 25 PID 5048 wrote to memory of 5040 5048 RUSSKAYA-GOLAYA.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Company\NewProduct\koollapsa.bat" "2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\al99999.vbs"3⤵
- Blocklisted process makes network request
PID:4776
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Company\NewProduct\all2.vbs"2⤵
- Drops file in Drivers directory
PID:5040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258B
MD54f13c561e8c1a666e912afefd7cf758d
SHA19cfd5e512bbc2be7ed670f85a731d97a83c71077
SHA256ebb4b61362f29913fab27388fbd70963155333eee1cb4e94110730c82d4eab40
SHA512e7395661df1e81db2575900162112020dd5b6e82debb1e9c419c4399bab92d1ddbb50d0f33f9df54716c7c9398e86013cdfac82f4c2ed0e7e756f068679f3d54
-
Filesize
703B
MD52d6ea08436f0586e48170422bab7c38a
SHA137c85b8e2fa65881ee79703fc24ef6116d0e9ad1
SHA256a119e8db9020bc3e9a540dae375bfb2ab3b136714544d6d765f7dc9c31448dce
SHA512e00428d180204fc258c137fcb8b65226ed3eda7f3f488f8194a1b58f0babc2b9e0d694492e376f819eaca70c79f09925ee86f26307e32f10924693e4bab33a01
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
2KB
MD572aa207e9713c3869aab3ee8d4d16813
SHA16276deeebee93166a2f075ead56cb8532a378d7e
SHA256474a48dcca705150ee9342fc8a076f4ec684d1e50240f5b0c7823500e622240f
SHA512e2697f2effd036a7c24f57c957118b98eb6797be356ee34739e655ed0dfe4d637fc68e288e8c146f2f03af3adfda50d8a57ae44666fa5fe8034d3b3e3c064192
-
Filesize
53B
MD57c0760920e021c6d0bd65f24885a9486
SHA1e4e218108e76e6b0db2655b666e203969d1cfede
SHA256c1bf0846f0baac6aeace4f9c42e62c349304d0ebc0a97dc435758cb07ad96aa1
SHA5125f1cfd3454a1127106c1a1756b72f99a9a6dc5137a3a9f922b0f0111890cebdc1f6b90613e1246780762ed68f7578881726316467a45e198b491626c4c4cc686
-
Filesize
1KB
MD5d9a93296f8c62ab96271667c72d7a3b3
SHA1abcf5a6ed773cfc978fc2176138778ad406c188a
SHA256f6c84e7c7fced4ae3ee3ca143fd5e134a183eb1e2f67ab71a6e9a902596be993
SHA512f91de9fbc57397c895aa1bda0ed18601711b1da377ceeee9d5a5ff48a4a3ba2e4feaacf3c64475c07daf584d6374e79d8206a49d1e25bc3044b2e4b6c7d4bd02