Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe
-
Size
1.8MB
-
MD5
8cafa62b83baa9212ae40d5a8d17eb27
-
SHA1
150e10fb70391f6fb55dfa5afb6bba2537a9fa0a
-
SHA256
c140a22efe1bd008c3aa84dce4f1711b82cdf2caca46144ec1d49c5794daba2b
-
SHA512
11c5edc48d489449bd93fe85880729f20f5cc388af35a91e8d276eac02ab73203318921ed9d3095e30f05087522ea29094cf3f3c72d2996dda17e4d14c2f3345
-
SSDEEP
49152:lAl7W+/aXftgYZdLt/0YZL7m5hgPLT46181xKUpRHO4Ue0aGhAq9a8p7kP:lj+/aXGYZdLt5ZLS5ePLT461814ern0h
Malware Config
Signatures
-
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dinema.SendCoPlus.Application 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dinema.SendCoPlus.Application\ = "Dinema.SendCoPlus.Application" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\ = "Dinema.SendCoPlus.Application" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dinema.SendCoPlus.Application\CLSID\ = "{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\ProgID\ = "Dinema.SendCoPlus.Application" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\InprocHandler32 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE} 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Dinema.SendCoPlus.Application\CLSID 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\ProgID 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\InprocHandler32\ = "ole32.dll" 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D20B505-B19E-4FE2-9621-0527D4F6EFDE}\LocalServer32 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2368 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe 2368 2023-08-26_8cafa62b83baa9212ae40d5a8d17eb27_mafia_JC.exe