Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-01-18...ia.exe

windows7-x64

7

2024-01-18...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2024, 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-18_c263e7bac6e9bb255e50f27bba13679d_mafia.exe

  • Size

    412KB

  • MD5

    c263e7bac6e9bb255e50f27bba13679d

  • SHA1

    29ed17759703a793fe431f211ee709bc7b9425f1

  • SHA256

    0cc48759784f50a89d160da92702fade8c534a104722139cc89957eac3e90150

  • SHA512

    f725e8fe0aa94d5751f28ccb2b2fd30aebd99be5a64481fd342982dfecc5de9eb1d3b2454e3c74c69ac2fae54794a0326a9bf70789757ac90d12e879a3d32f53

  • SSDEEP

    6144:UooTAQjKG3wDGAeIc9kphIoDZni7qB98dEkYKuSwoIL/ckhF+wUgBoP:U6PCrIc9kph5A2B9UGrx3VLBw

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-18_c263e7bac6e9bb255e50f27bba13679d_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-18_c263e7bac6e9bb255e50f27bba13679d_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\1719.tmp
      "C:\Users\Admin\AppData\Local\Temp\1719.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-18_c263e7bac6e9bb255e50f27bba13679d_mafia.exe 3B60BE47AE17EFC5948A330B661EEC7472EB0776FACCE8E8B32BA5AAAC6964D2291034587C086A111D1984F8E152FD47948293D5F3A69C582B91A3369AB02E6A
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1719.tmp
    Filesize

    372KB

    MD5

    feffc2b358bf9649a19ccb7a18798094

    SHA1

    9958514cfd078170733643414ab622d75d8f8601

    SHA256

    b93161b1af9e2a5017cc1fb502a39ecb026ec2e513e83ec6f6111392857eb490

    SHA512

    8f3872977f16f4236b1742dba71336a89c34cf75a72ada5d9599ece87c78b17b285ea63d373c949450af5e27eae89a4a304a006b16081ce06f6fb45ac01f77ff

    Download Submit

  • \Users\Admin\AppData\Local\Temp\1719.tmp
    Filesize

    412KB

    MD5

    248ec7260a3bd0bbae2248d9e4cfe7db

    SHA1

    e441f2bf7dbe31b39b48620f27f0e0e100d3fe79

    SHA256

    a595f8d3b165501b3ebe8f877496e948646d704020598371ea03e22a13eae174

    SHA512

    5cd9b17c04583e946ec87ed003b4e79f3e8374aed63c4e30cff340aa1d2b7d8f621c4aef935a518a8bb826e2a7197ef0c006554191bef7fec7cca4bb8e34e2c4

    Download Submit