Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 05:11
Static task
static1
Behavioral task
behavioral1
Sample
RUSSKAYA-GOLAYA.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RUSSKAYA-GOLAYA.exe
Resource
win10v2004-20231215-en
General
-
Target
RUSSKAYA-GOLAYA.exe
-
Size
180KB
-
MD5
0807cdca2c7e165f7b0a11e4c9c1e782
-
SHA1
8e0238ff51d78cdbaf8df22983f98a60e5600ac9
-
SHA256
39e6435fa4030a9252678a3fb31b7a76dddd85e1a1dcfb5446fe0907a8918dc2
-
SHA512
1ebaf822e01e7f19f0af134cbedfc8d738f36f0fc89419bf0c46ff0d2002aafdd314074f42f0dbdaa67a92614ff1438480087958c4e9c6dc5e553bf8c98a5f2d
-
SSDEEP
3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hkflw/doa/kW1uTJ:zbXE9OiTGfhEClq9FfqoacWETJ
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 2572 WScript.exe 7 2572 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\nasri_v_moi_rot.govno RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat RUSSKAYA-GOLAYA.exe File opened for modification C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs RUSSKAYA-GOLAYA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2872 2908 RUSSKAYA-GOLAYA.exe 28 PID 2908 wrote to memory of 2872 2908 RUSSKAYA-GOLAYA.exe 28 PID 2908 wrote to memory of 2872 2908 RUSSKAYA-GOLAYA.exe 28 PID 2908 wrote to memory of 2872 2908 RUSSKAYA-GOLAYA.exe 28 PID 2908 wrote to memory of 2688 2908 RUSSKAYA-GOLAYA.exe 30 PID 2908 wrote to memory of 2688 2908 RUSSKAYA-GOLAYA.exe 30 PID 2908 wrote to memory of 2688 2908 RUSSKAYA-GOLAYA.exe 30 PID 2908 wrote to memory of 2688 2908 RUSSKAYA-GOLAYA.exe 30 PID 2908 wrote to memory of 2572 2908 RUSSKAYA-GOLAYA.exe 31 PID 2908 wrote to memory of 2572 2908 RUSSKAYA-GOLAYA.exe 31 PID 2908 wrote to memory of 2572 2908 RUSSKAYA-GOLAYA.exe 31 PID 2908 wrote to memory of 2572 2908 RUSSKAYA-GOLAYA.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"C:\Users\Admin\AppData\Local\Temp\RUSSKAYA-GOLAYA.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\chilli_v_zope\04en_cheshetsa_pizdets.bat" "2⤵
- Drops file in Drivers directory
PID:2872
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ez_i_baldei_po_polnoi.vbs"2⤵
- Drops file in Drivers directory
PID:2688
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\edem_na_adam\krasnoe_na_chernom\kutturotti\ne_zabud_hoppersi.vbs"2⤵
- Blocklisted process makes network request
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD561b3668ac2643b49bb2062a5888b215f
SHA105f2d46b1f48f61410d94b7a5d09441eebdf7197
SHA256a8e032c00b36d3d96bb8e83b0f51ebd80bcaf76b18fbeb965e200afef7951fa8
SHA512ae1e3b87573ecb4b3e234b2ef91d18aa0436a28bc8c76056b70f2d03266e08430b1abdcd45038cbc945553141bf05c976050055556abda798682b8c9f8e68401
-
Filesize
958B
MD57807a81232744da4d631a3fcb8434c87
SHA12571c7723d57acd1d626d43d4cc7e869f0e062f1
SHA256605964e767c3d79df7077e7529961ad53768b285302c4756f7e78676f5edcdf2
SHA5122ba2ab2bdb4d66d2b95fc2a741f2e55a130ec97235ea0c200fb98fdb1a54193437778eecc58a0a790efb5384255ca9095ecce6a306afb3cabf4111726e7feaa8
-
Filesize
33B
MD57d94f52916ecca6d3c68eb13ab68a2ab
SHA1f40da9aa43d2208ab2ca0c0792572588b5f54c02
SHA256354b2baf1b5a08368077e053984063a0a94736e16d3d77aa259e7d212e50b92a
SHA512c15e0655df3a745949926ff7b783b565a137916a3dfc52f15698643ac8405223259d2ae7641e4d4ab572f926cd0b192a500ef10349cab60b1e92da838497fd0c
-
Filesize
701B
MD5418848d826afad54d50ab0e4a1e2f750
SHA1bc5d9717e420d21124184abbd96fb3d76da9ba07
SHA256b9e388632f526a07145de6ba772aae8c71c2db5ef6a76e3cf21d120918d45d6c
SHA512ad7b4a60a9bf0078b014f8821b021a653638f7f04b3b8b56548e284cbec2b245cf0f6fb75ddf84afd4e68ff950c1d19921cdd909b8153ea4943d45aadfd02744
-
Filesize
1KB
MD525ee27baa31c59fdf6cf5d18955ef985
SHA151d4725afa6d997cb7347c60a7d17485a8fb2ea7
SHA25675daf3b3c78bc2038351bee72d6036edf869f7106da7366722b1cd03f26f195d
SHA5128a4e1f971b8158db5df7b24b8f0d317d2397209c21ab07c6e6014bc767bbc95e32093fb59e2e67369687c9ed024ff6d354652d02424a8050500a410369abe12e