Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe
-
Size
414KB
-
MD5
afc5b144d11a58ba3264f729619abb70
-
SHA1
a26939f253c9be350f1b769532f132a67e6ce8b4
-
SHA256
c2764102b75b724a367ffe078ed285fd9571ecdc064dc2bd0bc7bad993e17d4e
-
SHA512
c932858fef1501211e09b0d1789e6bb8c1e30de42c759c53e2c646c530c4cca5a7013e0c103cab25f0fbf196fe01074868688c84ae4358a204787ba642f38b2e
-
SSDEEP
12288:Wq4w/ekieZgU6VKR/4OE8H2jI+Joc1Sl:Wq4w/ekieH6UWOnHeIzcA
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2060 22DC.tmp -
Executes dropped EXE 1 IoCs
pid Process 2060 22DC.tmp -
Loads dropped DLL 1 IoCs
pid Process 2284 2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2060 2284 2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe 16 PID 2284 wrote to memory of 2060 2284 2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe 16 PID 2284 wrote to memory of 2060 2284 2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe 16 PID 2284 wrote to memory of 2060 2284 2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe 1CE986E9DA7F84CDC476955602B5D2933F7F683D0AC49FAEA491FA47A4FB48D263CA86264E393E7D15E2824134BD1F71A1F0DB96F2B5603EE21DC0BCEFE12C581⤵
- Deletes itself
- Executes dropped EXE
PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-09_afc5b144d11a58ba3264f729619abb70_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5e834545be73254c8db0fd3787c810427
SHA13a4862db7caf1d3fb85eed534b99584b906165ba
SHA256ee52e1896adf73f739a0dfc4b940dc5e765a3da236ba28e6c29cc6252379bf85
SHA512f7b1a2f8c322b0224d8b9fedb69352569942165f503b42cd40d697347b1aed4f6a8d6da92fcf19f360cc5ebcd34f4346a8e567b64bf66de0e507a8903ffbb2ec
-
Filesize
98KB
MD56fa104a6a5c889a69413382f1668057c
SHA118552af8991cc1b858fd90c2e92f0bca606ac6a0
SHA256e939bd9775ca3c1923923d36b522b4f8050d4e4f187bb0fe02e9be50c08b8591
SHA512b71dc82acfc696bddff8e39186a30fec20859a679ad29d982f445b70836881440b104ad251b80cf31a0a595964d0ebb4d3fec6857a2b08fef0b9eb68a95da1bb