Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 05:11

General

  • Target

    RUSSKAYA-GOLAYA.exe

  • Size

    180KB

  • MD5

    0807cdca2c7e165f7b0a11e4c9c1e782

  • SHA1

    8e0238ff51d78cdbaf8df22983f98a60e5600ac9

  • SHA256

    39e6435fa4030a9252678a3fb31b7a76dddd85e1a1dcfb5446fe0907a8918dc2

  • SHA512

    1ebaf822e01e7f19f0af134cbedfc8d738f36f0fc89419bf0c46ff0d2002aafdd314074f42f0dbdaa67a92614ff1438480087958c4e9c6dc5e553bf8c98a5f2d

  • SSDEEP

    3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hkflw/doa/kW1uTJ:zbXE9OiTGfhEClq9FfqoacWETJ

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe
    "C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat" "
      2⤵
      • Drops file in Drivers directory
      PID:2872
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs"
      2⤵
      • Drops file in Drivers directory
      PID:2688
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs"
      2⤵
      • Blocklisted process makes network request
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat

    Filesize

    2KB

    MD5

    61b3668ac2643b49bb2062a5888b215f

    SHA1

    05f2d46b1f48f61410d94b7a5d09441eebdf7197

    SHA256

    a8e032c00b36d3d96bb8e83b0f51ebd80bcaf76b18fbeb965e200afef7951fa8

    SHA512

    ae1e3b87573ecb4b3e234b2ef91d18aa0436a28bc8c76056b70f2d03266e08430b1abdcd45038cbc945553141bf05c976050055556abda798682b8c9f8e68401

  • C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs

    Filesize

    958B

    MD5

    7807a81232744da4d631a3fcb8434c87

    SHA1

    2571c7723d57acd1d626d43d4cc7e869f0e062f1

    SHA256

    605964e767c3d79df7077e7529961ad53768b285302c4756f7e78676f5edcdf2

    SHA512

    2ba2ab2bdb4d66d2b95fc2a741f2e55a130ec97235ea0c200fb98fdb1a54193437778eecc58a0a790efb5384255ca9095ecce6a306afb3cabf4111726e7feaa8

  • C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\nasri_v_moi_rot.govno

    Filesize

    33B

    MD5

    7d94f52916ecca6d3c68eb13ab68a2ab

    SHA1

    f40da9aa43d2208ab2ca0c0792572588b5f54c02

    SHA256

    354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a

    SHA512

    c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c

  • C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs

    Filesize

    701B

    MD5

    418848d826afad54d50ab0e4a1e2f750

    SHA1

    bc5d9717e420d21124184abbd96fb3d76da9ba07

    SHA256

    b9e388632f526a07145de6ba772aae8c71c2db5ef6a76e3cf21d120918d45d6c

    SHA512

    ad7b4a60a9bf0078b014f8821b021a653638f7f04b3b8b56548e284cbec2b245cf0f6fb75ddf84afd4e68ff950c1d19921cdd909b8153ea4943d45aadfd02744

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    25ee27baa31c59fdf6cf5d18955ef985

    SHA1

    51d4725afa6d997cb7347c60a7d17485a8fb2ea7

    SHA256

    75daf3b3c78bc2038351bee72d6036edf869f7106da7366722b1cd03f26f195d

    SHA512

    8a4e1f971b8158db5df7b24b8f0d317d2397209c21ab07c6e6014bc767bbc95e32093fb59e2e67369687c9ed024ff6d354652d02424a8050500a410369abe12e

  • memory/2908-48-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB