Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 05:46

General

  • Target

    2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.exe

  • Size

    467KB

  • MD5

    9386ee894fbf5654a11c86d7c9bee2fa

  • SHA1

    c85a4f4beb49fe2e08d163fa0321c978b2ae3129

  • SHA256

    09bd623c7c29f0247ff357ddf4ca0fd0e781602902698075226120d6c18771fb

  • SHA512

    23466fbd0fc6005e34cba6460425a34a25ff9df6be84fee77ffc0b90928a7da6d3d4428e0dc829fcbd65973f04cf7b2452d78347a4a8fa0f83d3e9b87e4561a4

  • SSDEEP

    12288:Bb4bZudi79L1ihhFNF8vyw5Hhy/y3IXy8khcvAk:Bb4bcdkL1ii/5Bya3Iamf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\8E89.tmp
      "C:\Users\Admin\AppData\Local\Temp\8E89.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.exe E4E0730DB16618FEAE16BBEAA1D8A65D58946600FB0DE1575DDCE66865D352A40F09453F7287BA4187621FC928985FB82D712E7D076A5E528ADB1EBBADE1F542
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.doc"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:2832

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2024-01-01_9386ee894fbf5654a11c86d7c9bee2fa_mafia.doc

      Filesize

      35KB

      MD5

      a6b03fc9e5439b7504ba08010a960962

      SHA1

      e93a74f35ac1ed020158642eb1f2087fd31fc7c6

      SHA256

      b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

      SHA512

      decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

    • C:\Users\Admin\AppData\Local\Temp\8E89.tmp

      Filesize

      467KB

      MD5

      f2cf428f9cce1e3bc5ab00662b56e1cc

      SHA1

      0aa704f3cbed76b7aa5e5dc203458d0c64192e61

      SHA256

      8196513b848e634c51d1c772c1b2ac200679fb164177f646e69153df000d1b59

      SHA512

      4eaaf5299fa3c40eac0ec7d57fd18269b84c6b03ac5e846ef3859144d7371df0e15b0961aec7c48621595356182b4adca28848fbfdd9e5f2d7a0c3466b9056d1

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      c8bf0694466370d23f435fe3b6d580e2

      SHA1

      64b82c911e472b3cceac1413e87fda823100b593

      SHA256

      0e671c744bd68c9f749f6903264389f81e90741593de0547f85a467576b8b1fc

      SHA512

      19f829fddd6f95ff98fdd105a746bc6c06bb042f7439b77ffdbc45170cbef6a7b27d40499b81d2ff57c410c2f83e8af072b4d3f926dc48b2feb75330f0644b04

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • memory/2032-7-0x000000002F8F1000-0x000000002F8F2000-memory.dmp

      Filesize

      4KB

    • memory/2032-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2032-9-0x000000007161D000-0x0000000071628000-memory.dmp

      Filesize

      44KB

    • memory/2032-28-0x000000007161D000-0x0000000071628000-memory.dmp

      Filesize

      44KB

    • memory/2032-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB