Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/01/2024, 05:48
General
-
Target
2024-01-10_3e4f63c906030607a612b7dd1e4537f7_mafia.exe
-
Size
479KB
-
MD5
3e4f63c906030607a612b7dd1e4537f7
-
SHA1
1d906b8c8a1813f4d04aa75700c216e5069709e1
-
SHA256
518366acd7c49e2d920b4273d24096d79a59d1a36f15f81e252111571d3c9917
-
SHA512
063c741c86e9b75fe7660c7b5da8da577ac0f9f8e71d72cc282a43f47d578f828dc27d0314458490f9765eeec457709658af8411ff1e3b21aadc674f931691fe
-
SSDEEP
12288:bO4rfItL8HAIkrzfo0m82mmy5r44OHWEENsMIgMcReKQ75UO:bO4rQtGADzd2mtqGMcReDVUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-10_3e4f63c906030607a612b7dd1e4537f7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10_3e4f63c906030607a612b7dd1e4537f7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-10_3e4f63c906030607a612b7dd1e4537f7_mafia.exe D57E62EB7366673C89F40834FC43FCD7299D3F0C0874354A6A208F19201041C6AA78491A660A16B2A38DAE1B7D7C19EC710C8880FD45217609FC034715FB0D6E2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD5c72868e5367374f24698c003891da6ab
SHA10b74ad0cccc2d2d9864878cc80421ea1a5bffaca
SHA2564f1c4643080616a9323e911b1219806677bc6f2e4bed9ff85457ab763322fdf9
SHA512fe78f3454ffc71e1d53a43f8f2707ac664374161691e0407fe9da512d908de15a559b360e2c02a269bf91f88d5d67fbfb09f70dd308f8483912bc0f62fb1a5d7