Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 00:13

General

  • Target

    GOLAYA-DEVOCHKA.exe

  • Size

    238KB

  • MD5

    abba37efd3a03df55c6a615e9762f9e5

  • SHA1

    0cbd015b62ef4a188e29d5ccc82eff6dbb75e02e

  • SHA256

    47a9d86207338ad60e9820fe3c947485290d6138540354fd741747395229875d

  • SHA512

    31c133da63cde479a2e16a4472a8c9bdc98db41750bc594e4165e30c87767d845dd4ecd40e064760bc1e04208f267ba0c63a8651f7278b8c2c3d29b00159cf74

  • SSDEEP

    3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hFHPhnw4NSmNjxXyAIVragLR+ncvLn1l+C6:+bXE9OiTGfhEClq9cyHO9XFAugLKJJUm

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe
    "C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "
      2⤵
      • Drops file in Drivers directory
      • Drops file in Program Files directory
      PID:2696
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"
      2⤵
      • Blocklisted process makes network request
      • Drops file in Drivers directory
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross

    Filesize

    1KB

    MD5

    f4b65959c7c31a3a31ca9f2080555910

    SHA1

    74aae7370da8db12001e4733a13eb8e01a21efd0

    SHA256

    a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5

    SHA512

    f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat

    Filesize

    1KB

    MD5

    6f8784f2b895a46ee40a54b47fad1349

    SHA1

    2b30224f5f893489f9ced2f7ba60f1d3668bba9f

    SHA256

    f982068db2c241f784a0ba831d664747d8445a0f5f91ee4d439fd4755e9daccd

    SHA512

    607f7370a664ae33111080deff3e5794de92ab55f165b259c39dba8c02190f93264bbbb0b3ef6032002ffdee4e674475957f48f1465684c52954878a0d6ec6bc

  • C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok

    Filesize

    99B

    MD5

    86dc7199339e9623d9cb19240a752740

    SHA1

    71cb2333efd767a21c031c23bb5b7e81115aff18

    SHA256

    c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370

    SHA512

    eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d

  • C:\Windows\System32\drivers\etc\hosts

    Filesize

    1KB

    MD5

    62f349a8cbe23f76b9a64af91c4901f3

    SHA1

    27fa28e6e22e320bdaeea11ad9be50ce85f0ae15

    SHA256

    11d67412a287aa262b5d3dda16a28e27d099186632883beb83d430396ada0536

    SHA512

    8574b744600558492d36cfcaff66ff344fc51dd7e7947e1b8247311a2ec73d11dd051791c10d864af77f7f7166aa340e6b4a2319f1c42f1f90ac6dff12d0fec4

  • memory/1760-44-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1760-48-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB