Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:44

General

  • Target

    GOLAYA-BABE.exe

  • Size

    150KB

  • MD5

    13064a1549e859958c07462c9b2f0a58

  • SHA1

    da6a8be2da028023ad9a350845eae67a64b5bf7e

  • SHA256

    dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea

  • SHA512

    f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533

  • SSDEEP

    3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-BABE.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"
      2⤵
        PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "
        2⤵
        • Drops file in Drivers directory
        PID:2780
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"
      1⤵
        PID:2624

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs

        Filesize

        789B

        MD5

        fbfaf5456d9016723c58958bbb6fcb99

        SHA1

        38d0c30b1d89f76a0471f528d6f3536061661a9b

        SHA256

        22dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d

        SHA512

        537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6

      • C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak

        Filesize

        27B

        MD5

        213c0742081a9007c9093a01760f9f8c

        SHA1

        df53bb518c732df777b5ce19fc7c02dcb2f9d81b

        SHA256

        9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

        SHA512

        55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

      • C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat

        Filesize

        3KB

        MD5

        25a0b02e83ef7cc0e50772e9ca8fdbe9

        SHA1

        5bf8d941645128fc22548c44d1cb9f64b0cfb360

        SHA256

        fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863

        SHA512

        b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd

      • memory/2028-72-0x0000000000400000-0x0000000000422000-memory.dmp

        Filesize

        136KB