Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
GOLAYA-DEVOCHKA.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GOLAYA-DEVOCHKA.exe
Resource
win10v2004-20231215-en
General
-
Target
GOLAYA-DEVOCHKA.exe
-
Size
238KB
-
MD5
abba37efd3a03df55c6a615e9762f9e5
-
SHA1
0cbd015b62ef4a188e29d5ccc82eff6dbb75e02e
-
SHA256
47a9d86207338ad60e9820fe3c947485290d6138540354fd741747395229875d
-
SHA512
31c133da63cde479a2e16a4472a8c9bdc98db41750bc594e4165e30c87767d845dd4ecd40e064760bc1e04208f267ba0c63a8651f7278b8c2c3d29b00159cf74
-
SSDEEP
3072:TBAp5XhKpN4eOyVTGfhEClj8jTk+0hFHPhnw4NSmNjxXyAIVragLR+ncvLn1l+C6:+bXE9OiTGfhEClq9cyHO9XFAugLKJJUm
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 316 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation GOLAYA-DEVOCHKA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs cmd.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe GOLAYA-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat GOLAYA-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok GOLAYA-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.exe GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\Uninstall.ini GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\xranilise_vsei_figni_tut.bok GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.cross GOLAYA-DEVOCHKA.exe File created C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos GOLAYA-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\nu kak bi vsua hernya.fos GOLAYA-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings GOLAYA-DEVOCHKA.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3632 wrote to memory of 2272 3632 GOLAYA-DEVOCHKA.exe 84 PID 3632 wrote to memory of 2272 3632 GOLAYA-DEVOCHKA.exe 84 PID 3632 wrote to memory of 2272 3632 GOLAYA-DEVOCHKA.exe 84 PID 3632 wrote to memory of 316 3632 GOLAYA-DEVOCHKA.exe 86 PID 3632 wrote to memory of 316 3632 GOLAYA-DEVOCHKA.exe 86 PID 3632 wrote to memory of 316 3632 GOLAYA-DEVOCHKA.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"C:\Users\Admin\AppData\Local\Temp\GOLAYA-DEVOCHKA.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\idol ya poka_\no_lover_simp\svezee_techenie_cheloveko.bat" "2⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
PID:2272
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\idol ya poka_\no_lover_simp\slooooowthespeedafer.vbs"2⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
PID:316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f4b65959c7c31a3a31ca9f2080555910
SHA174aae7370da8db12001e4733a13eb8e01a21efd0
SHA256a2b30b33d996b98e74fabe9761793438391e23b889663d03d682acbd708573d5
SHA512f57792a60613d3d8335d679d3641ec4f577534dcde2a7256de2d2448a38ca87301aba678b3f6fc0e057f12eb51c74ef660367304c6d927b0ddfa7312912eb97e
-
Filesize
1KB
MD56f8784f2b895a46ee40a54b47fad1349
SHA12b30224f5f893489f9ced2f7ba60f1d3668bba9f
SHA256f982068db2c241f784a0ba831d664747d8445a0f5f91ee4d439fd4755e9daccd
SHA512607f7370a664ae33111080deff3e5794de92ab55f165b259c39dba8c02190f93264bbbb0b3ef6032002ffdee4e674475957f48f1465684c52954878a0d6ec6bc
-
Filesize
99B
MD586dc7199339e9623d9cb19240a752740
SHA171cb2333efd767a21c031c23bb5b7e81115aff18
SHA256c374079002e58508af7c8de08bf7e98b72a0d11b44650dcbb89f31d15e887370
SHA512eee63bbf12c45ba73cfb543d0069288090410e91ef484587dde79995a585ef510d295d4de19701feb5704167b3d0ba01cf0a40f00c42abf29825e1f2bf917f5d
-
Filesize
1KB
MD54fccb4d0b47dfce4da0002ee30fc74e6
SHA1e5e9311650e7631800cd404d2aa7df00e4b169d3
SHA2562554b9fc2dd8cdb75ac6e3650a9b5fe0b90d40a7bb04625b021aaf6d0e1a1499
SHA512951e1f0a5636052f32b7990201cc1d855d8bef07fd247fe95f87dfc20c314c3945fecb549e402445543fadd60c5c46db4d028391a690c84bd6a8308d335adacd