Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe
-
Size
479KB
-
MD5
60447936cde27d5b3b52546a97b41662
-
SHA1
48b7bd953ec750ef9935153ed51c81cb86433266
-
SHA256
e9d212c7d0084babb5bb9228f16656d7f191eb3fb150a45fdd855d9a876ff92f
-
SHA512
4f8268996483ad1080156e2bf82a4e8b12f2e85b1bfc84e7044ef80dbfe5070e2f17bab6e112874008830df85708a3a0f1319d9072bf5a8d5b96e8676d36c49e
-
SSDEEP
12288:bO4rfItL8HADbsCnp+vnYgM5yLR/QjzBJh+hCeo75UO:bO4rQtGADoCnAvnCsIzBKnoVUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1528 544A.tmp -
Executes dropped EXE 1 IoCs
pid Process 1528 544A.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1528 1648 2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe 23 PID 1648 wrote to memory of 1528 1648 2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe 23 PID 1648 wrote to memory of 1528 1648 2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-06_60447936cde27d5b3b52546a97b41662_mafia.exe 6BD15592AE7B36CF622850C85B3F19E4A3FC97FDAC72E60B8A11680D84B79D13AA5AF57DFBE26156A0E300FC082EBA0E9C1EDEF7E5CA23BBB7027C9DDE4C9FD52⤵
- Deletes itself
- Executes dropped EXE
PID:1528
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD56ab08db4ef520223a741ea07c7204846
SHA1eb636adbf5c8bd7d19a50ca98c1ec3a3f4807402
SHA256352e4df132878ca347954655830d4a4429ec115f7dafdfbb4f2682e36df05e73
SHA512bd5000779ece106e4ae6c22c63b9467ef64741b03fd4707fa54d6fb03537a9d03b35a679cfae3e408fc3b3f8487f73c0375b496ed6077370f4e7adfaf480374f
-
Filesize
92KB
MD5928687b0ecdfdca0823f9be1deea56cf
SHA1bc91e2df093ab29a40daee507e6a1528fb86fd62
SHA256fae497adc5fee9f3a1575f0e2974ca974b171198fac0f9fa77069ecdb36bfcd8
SHA5122ef53f969fb690606bb9ae73992062b23356c8e5b81d7a6971b2921cafb59f9d2bcf7e08593429d4b8b2ec6b4bcf7031a09971b211f91c86fb6684e19f3ec1f4