Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe
-
Size
468KB
-
MD5
9001b22d72d76f1072daa7573021c1fc
-
SHA1
168987e7395071d7dde7a594062137fd9d4b7f94
-
SHA256
a113edf3c9e94f7d8eeea9126efd24d7de866dc637c58f035704483aec471352
-
SHA512
e9ccd0e8a49ab2cec878e9e9350bbc2fe9babcf5d01296d829c191b0b3da920ff80527c502c7590253e177cbff3828c102d205486f0a1ac8f9b841097e11e602
-
SSDEEP
12288:qO4rfItL8HGtZkROese3aY/Sq2uv217bWmeEVGL:qO4rQtGGoLXn/SqmumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1388 4834.tmp -
Executes dropped EXE 1 IoCs
pid Process 1388 4834.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 772 wrote to memory of 1388 772 2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe 20 PID 772 wrote to memory of 1388 772 2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe 20 PID 772 wrote to memory of 1388 772 2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-08_9001b22d72d76f1072daa7573021c1fc_mafia.exe 6856695F02C04EB5EA0E85AF261CF7492939032CE1E789B604CA06BD62A13C15581DBE87DD747171015EB133F11878C5F56096D2B1714ECBCBEC0C49D9172C4D2⤵
- Deletes itself
- Executes dropped EXE
PID:1388
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5d830e0b1247068125dfd5e353ddf2ba7
SHA13d59991308d7a0da15b5e5160821004e016aa56d
SHA2566abc2fcf087a648c8b0ec137109826b441f722a3a4ef341ef3e1c0091f59077d
SHA5121923268f392801cd47c26020b7376f73923d0503343390db51d846ec203a5e5912086e4422739162a646953b27f13e01a6c8a881000589fcc07c6ddd70890702
-
Filesize
94KB
MD5738fd1be7e2ed27c5ff1fd2d6c803705
SHA17583fc29a5e55ef61a9c6247fc4935cecd99fc77
SHA256189ad2fa80fc837e17ba212a3bf422f62ac0b49f06e64bbdcb1e4eaa355ad2b2
SHA5128e5156434ad58ee47dde516a5f0b2d17c2b0588e904395bd16facc28d9f0af4bb8c577f05ce2c0ede89408b73cc4ae9db3aedbe94a5263894c7c86addcb5a048