Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2023-08-26...JC.exe

windows7-x64

7

2023-08-26...JC.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    138s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 01:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-26_251a75aed4158fe3093ed4aba9eb091b_mafia_JC.exe

  • Size

    2.9MB

  • MD5

    251a75aed4158fe3093ed4aba9eb091b

  • SHA1

    d54c669d5e1515677b06a6a177dd884dd9b8a393

  • SHA256

    4f4c6e08474205d29d6f93e77afcc0fc3cde8c9f945de3d26b0b5d8b2c95d9cd

  • SHA512

    73851230c8bf575e1d69df23481fc11c89d299c6f50fa7da981469cdaead3ca428791c127c19fc25b5ecfd0676cd3a57ee402749cf132b3dbc1517355266d6c2

  • SSDEEP

    49152:fWnAteSAYvPsqD2AQLRgcTPC4YEeZB92k0Z/6b9HC8ds1mqklFC76g4WRA0DayzZ:7teSAYvPt2AQRTPCKez970Z/6b9HC8dg

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-26_251a75aed4158fe3093ed4aba9eb091b_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-26_251a75aed4158fe3093ed4aba9eb091b_mafia_JC.exe"
    1⤵
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4392-2-0x0000000010000000-0x0000000010024000-memory.dmp

    Filesize

    144KB

    Download