Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-BABE.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
GOLAYA-BABE.exe
Resource
win10v2004-20231215-en
General
-
Target
GOLAYA-BABE.exe
-
Size
150KB
-
MD5
13064a1549e859958c07462c9b2f0a58
-
SHA1
da6a8be2da028023ad9a350845eae67a64b5bf7e
-
SHA256
dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea
-
SHA512
f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\90909090.ico GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.exe GOLAYA-BABE.exe File created C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.ini GOLAYA-BABE.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak GOLAYA-BABE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2780 2028 GOLAYA-BABE.exe 18 PID 2028 wrote to memory of 2780 2028 GOLAYA-BABE.exe 18 PID 2028 wrote to memory of 2780 2028 GOLAYA-BABE.exe 18 PID 2028 wrote to memory of 2780 2028 GOLAYA-BABE.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"2⤵PID:2672
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "2⤵
- Drops file in Drivers directory
PID:2780
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"1⤵PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5fbfaf5456d9016723c58958bbb6fcb99
SHA138d0c30b1d89f76a0471f528d6f3536061661a9b
SHA25622dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d
SHA512537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
3KB
MD525a0b02e83ef7cc0e50772e9ca8fdbe9
SHA15bf8d941645128fc22548c44d1cb9f64b0cfb360
SHA256fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863
SHA512b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd