Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 06:04

General

  • Target

    2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe

  • Size

    468KB

  • MD5

    afde6aeff1188dbff7e22c65ae6aaedd

  • SHA1

    fbaf017e89c02f388695e264f57100a8a7b11d2d

  • SHA256

    db7cacb6feef2c3081bb100a5219f5ee6fa4f2b6efb50b6f1aa8ca56be1d4f29

  • SHA512

    518650ddef88ec8997b3df286789f454cfc6fc2d458be019e9e9257b4d22bfd03b74ecd0929422ceaba29a3c884fd495d336ca98debdf874e6c781e904178b88

  • SSDEEP

    12288:qO4rfItL8HGz4loXXkcRsq9yZdHuv8jgbovfL2U7bWmeEVGL:qO4rQtGGIvce2Xv0tpumeEVGL

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Users\Admin\AppData\Local\Temp\8889.tmp
      "C:\Users\Admin\AppData\Local\Temp\8889.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe EA9F6276A5246C66BCAEC502535FF726C3DFC23BB126F45FC27285CC56D8287728FF2314D13607FCE887381B12B336559056277DBF8CCADA263BA5D8A88C7246
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8889.tmp

    Filesize

    57KB

    MD5

    86793f514c471694cc14e934c6fd25d4

    SHA1

    e877739b53993823877ebe982caa63e4fe961be1

    SHA256

    6f802e8b2be5ca2e8855b215b9d8318783476116c688603a84b25f1368e9b2f1

    SHA512

    79d8ab1f7c6db1bc0e536399b8065b15bda33b2e15a9e48e432d9828636024cefeb55fdd651e20a518b973d348d738aca3ac5484f0ae5a20703ffd01d43223e1

  • C:\Users\Admin\AppData\Local\Temp\8889.tmp

    Filesize

    5KB

    MD5

    07c73fd5a4812fa046556352b5b8f266

    SHA1

    4db3f5348c183d7cdd5828e4879689840bf26cef

    SHA256

    a718682a9e5d3ddbabbaa390b73f886c0579513507df45544fe266343db429c6

    SHA512

    a971ec9b8237a9d296ebc4784c22b1a19777eb0da86b3c1a0a2048f8aa56628b30c5a23594bea5b79a8081355db8ce036c99909b57591d97f99f774ddd2ef538