Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe
-
Size
412KB
-
MD5
a596f9e6979d52cef92705811189a5e0
-
SHA1
a4e280e38e4f70c7fe107c71c967d560e1451a90
-
SHA256
888d0458be5c59e4fb353038cacae0efc612d364a3c970b420c06d9df7b5471a
-
SHA512
22ff9d7d553caef101d97b3855b7625ba80a893374832dc07cf31b61e5a0cd2dc0f0d332d025004e1fd61ea6352c6039c7e5abc39ac4f91c35724b1b35857356
-
SSDEEP
6144:UooTAQjKG3wDGAeIc9kphIoDZnrghNqZD9yPMny4UmeFWhbCFP:U6PCrIc9kph55ghNqBEMnWmvYt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1104 8759.tmp -
Executes dropped EXE 1 IoCs
pid Process 1104 8759.tmp -
Loads dropped DLL 1 IoCs
pid Process 2236 2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1104 2236 2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe 28 PID 2236 wrote to memory of 1104 2236 2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe 28 PID 2236 wrote to memory of 1104 2236 2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe 28 PID 2236 wrote to memory of 1104 2236 2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-09_a596f9e6979d52cef92705811189a5e0_mafia.exe E6782E1767BC2615BDE69374ED628007882915348DF8A166C67D79F6A12D5B7D23F5A7E523194BC0D8A3A1F147ECB1B8B3D1DB25DD002A37933658FD9941BF402⤵
- Deletes itself
- Executes dropped EXE
PID:1104
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD525533f6aaa401aada137c85faf2c9086
SHA150ba2e84824639aec41df743c8d7fc8d75448bce
SHA256486ae2bd369239045c28662c56bfd937988a39c2cc49472fc982eb30b5b0ea34
SHA5126cd3da8bd3ee092c629ecb5f9204a3b2682e14e4d3e90f16b6756e0804ca66a8c2b20e341f803479eafa54cff7000b6178816506e953b6a978da98a28dce0803