Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe
-
Size
412KB
-
MD5
1368c497c6dfee32c1616c5b7685e6d6
-
SHA1
0bac08e8e56b12212ae051fa8daaff4cd7a2121e
-
SHA256
185b08fae3c7f396c24573d212131175ccfda559dbce36d533e9e2df489c51b8
-
SHA512
a9504f8a7ee9587d6574cdf528d29ef5fa062b943db277972f94211291c6bc44c76b9c2cccea3a51f1458b7edb4280f4586967fb926784f275c5c4c71fec006e
-
SSDEEP
6144:UooTAQjKG3wDGAeIc9kphIoDZn75uOIDtH4tUC6InwI8iogORJf7gzib7uP:U6PCrIc9kph5YDlgJnbogO7fMz2K
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1984 433E.tmp -
Executes dropped EXE 1 IoCs
pid Process 1984 433E.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 1984 2908 2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe 84 PID 2908 wrote to memory of 1984 2908 2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe 84 PID 2908 wrote to memory of 1984 2908 2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2023-08-26_1368c497c6dfee32c1616c5b7685e6d6_mafia_JC.exe D1B7F68E2EC428BBC0C5FEC196EC8496D50661E412C9DEB24D9841F748E6B6B166C8AD7B93CE0E4CC3C0EE8404FE5C2DA5FDAFEE3A25BF8084D6350CF5CFF96B2⤵
- Deletes itself
- Executes dropped EXE
PID:1984
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD53a43902bc98d74523f7459b9529a5ebc
SHA1bd39d5187f4410e3fa424beb61b60f7336c5f7b2
SHA256b770f509ebea7b85678822d08710ca5643fb5d47022e479fd8cbf449b7745480
SHA5127b7cd267adcd8cfccd93804a5122d3c1bedcba4174694577bde9b481f7322d0e538ca55418453d16447e3753d248996892e4afe647ea1a227a9ea895586e8211
-
Filesize
412KB
MD53a43902bc98d74523f7459b9529a5ebc
SHA1bd39d5187f4410e3fa424beb61b60f7336c5f7b2
SHA256b770f509ebea7b85678822d08710ca5643fb5d47022e479fd8cbf449b7745480
SHA5127b7cd267adcd8cfccd93804a5122d3c1bedcba4174694577bde9b481f7322d0e538ca55418453d16447e3753d248996892e4afe647ea1a227a9ea895586e8211