Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3goodbyedpi...le.cmd
windows7-x64
8goodbyedpi...le.cmd
windows10-2004-x64
8goodbyedpi...st.cmd
windows7-x64
1goodbyedpi...st.cmd
windows10-2004-x64
1goodbyedpi...BE.cmd
windows7-x64
1goodbyedpi...BE.cmd
windows10-2004-x64
1goodbyedpi...LT.cmd
windows7-x64
1goodbyedpi...LT.cmd
windows10-2004-x64
1goodbyedpi...ir.cmd
windows7-x64
1goodbyedpi...ir.cmd
windows10-2004-x64
1goodbyedpi...ry.cmd
windows7-x64
1goodbyedpi...ry.cmd
windows10-2004-x64
1goodbyedpi...ir.cmd
windows7-x64
1goodbyedpi...ir.cmd
windows10-2004-x64
1goodbyedpi...st.cmd
windows7-x64
1goodbyedpi...st.cmd
windows10-2004-x64
1goodbyedpi...BE.cmd
windows7-x64
1goodbyedpi...BE.cmd
windows10-2004-x64
1goodbyedpi...LT.cmd
windows7-x64
1goodbyedpi...LT.cmd
windows10-2004-x64
1goodbyedpi...ir.cmd
windows7-x64
1goodbyedpi...ir.cmd
windows10-2004-x64
1goodbyedpi...ve.cmd
windows7-x64
1goodbyedpi...ve.cmd
windows10-2004-x64
1goodbyedpi...rt.dll
windows7-x64
3goodbyedpi...rt.dll
windows10-2004-x64
3goodbyedpi...32.sys
windows10-2004-x64
1goodbyedpi...64.sys
windows10-2004-x64
1goodbyedpi...pi.exe
windows7-x64
1goodbyedpi...pi.exe
windows10-2004-x64
3goodbyedpi...rt.dll
windows7-x64
1goodbyedpi...rt.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
goodbyedpi-0.2.3rc3-2/0_russia_update_blacklist_file.cmd
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
goodbyedpi-0.2.3rc3-2/0_russia_update_blacklist_file.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist.cmd
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_YOUTUBE.cmd
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_YOUTUBE.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_dnsredir.cmd
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
goodbyedpi-0.2.3rc3-2/1_russia_blacklist_dnsredir.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
goodbyedpi-0.2.3rc3-2/2_any_country.cmd
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
goodbyedpi-0.2.3rc3-2/2_any_country.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
goodbyedpi-0.2.3rc3-2/2_any_country_dnsredir.cmd
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
goodbyedpi-0.2.3rc3-2/2_any_country_dnsredir.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist.cmd
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_YOUTUBE.cmd
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_YOUTUBE.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_YOUTUBE_ALT.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_dnsredir.cmd
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
goodbyedpi-0.2.3rc3-2/service_install_russia_blacklist_dnsredir.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
goodbyedpi-0.2.3rc3-2/service_remove.cmd
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
goodbyedpi-0.2.3rc3-2/service_remove.cmd
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
goodbyedpi-0.2.3rc3-2/x86/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
goodbyedpi-0.2.3rc3-2/x86/WinDivert.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
goodbyedpi-0.2.3rc3-2/x86/WinDivert32.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
goodbyedpi-0.2.3rc3-2/x86/WinDivert64.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
goodbyedpi-0.2.3rc3-2/x86/goodbyedpi.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
goodbyedpi-0.2.3rc3-2/x86/goodbyedpi.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
goodbyedpi-0.2.3rc3-2/x86_64/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
goodbyedpi-0.2.3rc3-2/x86_64/WinDivert.dll
Resource
win10v2004-20240802-en
General
-
Target
goodbyedpi-0.2.3rc3-2/1_russia_blacklist.cmd
-
Size
274B
-
MD5
76763259e528cd27e998fb4c665c2b78
-
SHA1
f2b6e15dca04c54ace2aefc4bc72656dc7550cab
-
SHA256
69c8b67fafbca446ce5302e97f9947191ecb84d2a51eae61d4955dc3e2147da0
-
SHA512
69d35fb64ab4cee901b7ecc9baac437cd4dd5e3feb5b006a0fa8c3d52fce8ac9eea5ee68a6dcea01f5386966ac135e85bfba8fc8eecec5d8c70212e795d0dd76
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2220 1676 cmd.exe 29 PID 1676 wrote to memory of 2220 1676 cmd.exe 29 PID 1676 wrote to memory of 2220 1676 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc3-2\1_russia_blacklist.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\goodbyedpi-0.2.3rc3-2\x86_64\goodbyedpi.exegoodbyedpi.exe -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt2⤵PID:2220
-