Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 19:56

General

  • Target

    GOLAYA-DEVOCHKA.exe

  • Size

    238KB

  • MD5

    1414a0cf3ae3455f7445753aa9ef0ac9

  • SHA1

    c6e63022a267155926638e028ba0bfafe614ff15

  • SHA256

    2acd2fd6a3fbb4fe40a62ba571ed6015fdbec4a0a6aec9ccde3f33cbc803fee7

  • SHA512

    939e9f2dca756893d04a1619537ee7e71c7eda27ebf9785b16fe0e892327ba23d2bbc54d82b97e590d803ce01d89087eaf24b330572aa5ba14c0668d9faf29b0

  • SSDEEP

    6144:zbXE9OiTGfhEClq9rZXpdKw/F4qweYG3/jk8hqfFyBgRY7JJUm:/U9XiuiI

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\sri teplim kalom\singaraja eto les\fresh_meamings_cold_not_to_be_hero.bat" "
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      PID:4216
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\sri teplim kalom\singaraja eto les\sleep_my_darling_sleppp.vbs"
      2⤵
        PID:3132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\sri teplim kalom\singaraja eto les\fresh_meamings_cold_not_to_be_hero.bat

      Filesize

      1KB

      MD5

      74acc3839b6022585e2c1c7f7ad53f72

      SHA1

      7a5dee077413095eae8e8291ff82807644cd5912

      SHA256

      3be6d3561d4332cffcd516d9758b7ca63a59e9de3c1a859ca92e379963faf590

      SHA512

      9aefb31bd6544059f4c327b437b593a185cc0d06d07a4a7422362892aabdcaee80db85f0d1fb73c3e6c4da557b6726394e4403db8c3594f85e2c47934bf5bc38

    • C:\Program Files (x86)\sri teplim kalom\singaraja eto les\sleep_my_darling_sleppp.vbs

      Filesize

      1KB

      MD5

      17007b4656d76b453d7306cfd09a8565

      SHA1

      e908c6bebc96f295b29c78913bb595bfdc2c04a8

      SHA256

      2d1763c8e83f20f5b33f06f677b17ef8288c42ef64fccef432ba452c72bd9f3d

      SHA512

      406068fd0570cac510915f8d80cc045ea6afa69dd5653d47d2ea0b675c13a71d5b74d05e163d56c7f94786b4f99c34dd9ff9f8b9a75e85e6e9de0902d2e44a37

    • C:\Windows\System32\drivers\etc\hosts

      Filesize

      1KB

      MD5

      b4434980101442bcce3e0b0f6d12d743

      SHA1

      1a68111eba898c9b337b1dcd8cd803e339df5335

      SHA256

      9e8f7c183744c28ee7e84f2804a12185b1d330e25a929dd71c1adee6f6dbfb93

      SHA512

      86fc9e287d669446159989e463774cba0a5105c5394231782f41fd61cb41647ab48b4d773de11e06538721c4b10900548ac328e38fbfac217927dd9f9fdf9941

    • memory/5100-39-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB

    • memory/5100-41-0x0000000000400000-0x0000000000432000-memory.dmp

      Filesize

      200KB