Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 23:19

General

  • Target

    GOLAYA-SEXY.exe

  • Size

    180KB

  • MD5

    05dcabe4947ada380eb48cf90eb0aa6f

  • SHA1

    d11c9319a518ddc14dc62cc138d074b1d908c924

  • SHA256

    53b296ba46752bf57d298dfe5ba8b011574253199e57ffd8c8786bb16f642f49

  • SHA512

    a336ca962fe97f329fa6968e2532096a0051e5f124c20c7ba74d6688e5b15b2f34980b56f2b6f1e5ff3a53a05936510f22841279497ca50061e5c3fc55ea1614

  • SSDEEP

    3072:nBAp5XhKpN4eOyVTGfhEClj8jTk+0hJiH8ga2EPb9ePlO7/IQ1bvatjKv5sK2DdH:qbXE9OiTGfhEClq9j8ga2+b9ePlO7/IR

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-SEXY.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3328
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat" "
      2⤵
        PID:2964
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs"
        2⤵
          PID:4648
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs"
          2⤵
            PID:3048

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\hulioeglesias\give me malchik\ebi_manya_kon\so_my_name_is_brus_dick.bat

          Filesize

          2KB

          MD5

          d515dbabc1d4148509640420b7a56dc7

          SHA1

          5e3c3c4ae1882bd0aef3d9a3cbd527f2fdad6cc1

          SHA256

          db87b544d4eb7fb04ab140aaa18afa2b985f1636b19605715d22db93a2369063

          SHA512

          0d5140346185c9ebcc2447b33e4c279449ed8c5ca7b9ec961135848a4317ee79093a3f514f77d9c18bb337ca367375f15ac7b00493d0ffe2ac99836a4a9f808c

        • C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\ebi_manya_kon.rud

          Filesize

          33B

          MD5

          7d94f52916ecca6d3c68eb13ab68a2ab

          SHA1

          f40da9aa43d2208ab2ca0c0792572588b5f54c02

          SHA256

          354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a

          SHA512

          c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c

        • C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\krasota_ta_kakaya.vbs

          Filesize

          899B

          MD5

          c99bcd3152c111c27332bfc299c30379

          SHA1

          114b6dff436d74f361d8ca0b5bd4978adc3e9346

          SHA256

          8c7cc60f62079e6e6970ad0930850c114b22ebf4214310d4401159782c0ce111

          SHA512

          0f7b76e06cb6a4b7bf4a137a8ff24d51d32d266df43c1be54cf6185c00bb9fb621b587f58281684dd583e1ca58d0343e8d507a96e186f6a635dc8ff964e312b8

        • C:\Program Files (x86)\hulioeglesias\give me malchik\kandyvi\prich4ki_pouuuuut.vbs

          Filesize

          700B

          MD5

          a7d73318a92af8e3cfc771049d3edfac

          SHA1

          d9c5ab0e91ea4c71d8d9591f2851ca9282e3523e

          SHA256

          20b0d215ab3b82e181190a170660f0e9f816b149169001e6ca2daa08101ff7be

          SHA512

          c313aceb921c76d6c3bf0b35bfadff5a2479781a588300340ead4258c0ba4d6adb29a566873e981f8fed44a53b7ec88611c1d4366cb873743b472ba8a4f449df

        • C:\Windows\System32\drivers\etc\hosts

          Filesize

          1KB

          MD5

          7b561e5093eb943dbad98e4e1c72f91a

          SHA1

          f9174925f52ee2c7d0e09bf4993d7b12c6d268bf

          SHA256

          60e809d41d5772e3e7b2555ab949160c831e889fb7eb99cc95baf201f0657212

          SHA512

          69487f6d604e8d47ece431439a147e1672a185c90a132649c30a3540458d331eedc9923c24fe8261f811602573f830d2f4ce99d716c0906d72ce9374d8acb78a

        • memory/3328-31-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB