Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe
-
Size
468KB
-
MD5
afde6aeff1188dbff7e22c65ae6aaedd
-
SHA1
fbaf017e89c02f388695e264f57100a8a7b11d2d
-
SHA256
db7cacb6feef2c3081bb100a5219f5ee6fa4f2b6efb50b6f1aa8ca56be1d4f29
-
SHA512
518650ddef88ec8997b3df286789f454cfc6fc2d458be019e9e9257b4d22bfd03b74ecd0929422ceaba29a3c884fd495d336ca98debdf874e6c781e904178b88
-
SSDEEP
12288:qO4rfItL8HGz4loXXkcRsq9yZdHuv8jgbovfL2U7bWmeEVGL:qO4rQtGGIvce2Xv0tpumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 5020 8889.tmp -
Executes dropped EXE 1 IoCs
pid Process 5020 8889.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5080 wrote to memory of 5020 5080 2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe 34 PID 5080 wrote to memory of 5020 5080 2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe 34 PID 5080 wrote to memory of 5020 5080 2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-11_afde6aeff1188dbff7e22c65ae6aaedd_mafia.exe EA9F6276A5246C66BCAEC502535FF726C3DFC23BB126F45FC27285CC56D8287728FF2314D13607FCE887381B12B336559056277DBF8CCADA263BA5D8A88C72462⤵
- Deletes itself
- Executes dropped EXE
PID:5020
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD586793f514c471694cc14e934c6fd25d4
SHA1e877739b53993823877ebe982caa63e4fe961be1
SHA2566f802e8b2be5ca2e8855b215b9d8318783476116c688603a84b25f1368e9b2f1
SHA51279d8ab1f7c6db1bc0e536399b8065b15bda33b2e15a9e48e432d9828636024cefeb55fdd651e20a518b973d348d738aca3ac5484f0ae5a20703ffd01d43223e1
-
Filesize
5KB
MD507c73fd5a4812fa046556352b5b8f266
SHA14db3f5348c183d7cdd5828e4879689840bf26cef
SHA256a718682a9e5d3ddbabbaa390b73f886c0579513507df45544fe266343db429c6
SHA512a971ec9b8237a9d296ebc4784c22b1a19777eb0da86b3c1a0a2048f8aa56628b30c5a23594bea5b79a8081355db8ce036c99909b57591d97f99f774ddd2ef538