Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09/01/2024, 06:43
General
-
Target
2024-01-08_7d50a8e99ec5b54185b26285dd8321f7_mafia.exe
-
Size
497KB
-
MD5
7d50a8e99ec5b54185b26285dd8321f7
-
SHA1
2d4ebe174dcac140380188dbcbc02fb2eddbd359
-
SHA256
e1cb0c5c2492d3e92377ae48d124b65cc0724cde8f60e56fdb51a00d1428851a
-
SHA512
8a40130cd6f97291b63de2cb69b022000b244051fdf28d76cfd6c09301092fac9dfc594e2d8ff4c5f38f2168ce3d32b49e0b4ae3e8495af28642259dde197f52
-
SSDEEP
6144:1tup22IB7gOBkdFOUzdYG0zmIMcxXPoFjdz5CpIrMFdQ20e8EfxuR7CsX1o5AsYq:1tinoUyQOU+jxZKrOxuJCsX1/cv
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_7d50a8e99ec5b54185b26285dd8321f7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_7d50a8e99ec5b54185b26285dd8321f7_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2688\s2688.exe"C:\Users\Admin\AppData\Local\Temp\n2688\s2688.exe" ins.exe /e 12248950 /u 50b892e5-d96c-476b-834e-555c5bc06f2f /v "C:\Users\Admin\AppData\Local\Temp\2024-01-08_7d50a8e99ec5b54185b26285dd8321f7_mafia.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5709f5012028d4342464f9244e468f655
SHA1adea3d39c0b2356a5124c10bfeeaa7af7fa8593a
SHA2560fe9a2e6600582cff74673810979d3d89273088c2b9a07378df44e3cab7b14b7
SHA51212198b05cafb236934b11e655ebad407f45ac1b5a3502f7539ddc053a54e1c5cc933914899af6e48653a78236140ed4758b53ce1beab5bbc6823cee36cdf4b74
-
Filesize
40KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB