Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe
-
Size
499KB
-
MD5
936b8c49f88629b7f70b477d99acc0fb
-
SHA1
f530dd9f2d0eb3e85318efd04f2bd611ecedf266
-
SHA256
5f1030260cd482e61ec4cccda9f02b0c388dbbb767c52b936c4acfeeefccda67
-
SHA512
1b1b409a4d7462ab4b82edee314baa41360c2bcf11e971800772c47933c51096221fb9381321f9a44b7e43a7890f4d82d3d69db64970e42ece36a12b68062ca4
-
SSDEEP
12288:sO4rfItL8HP8oFouDhTkEYw7pFRrhCSIKBeiUj7dmsIhiqlj:sO4rQtGP8oiupK+FRrhBBeiUjAsIhiqp
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1736 3BF7.tmp -
Executes dropped EXE 1 IoCs
pid Process 1736 3BF7.tmp -
Loads dropped DLL 1 IoCs
pid Process 620 2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 620 wrote to memory of 1736 620 2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe 28 PID 620 wrote to memory of 1736 620 2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe 28 PID 620 wrote to memory of 1736 620 2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe 28 PID 620 wrote to memory of 1736 620 2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-01-24_936b8c49f88629b7f70b477d99acc0fb_mafia.exe CEE3B8633CDCAF28DB6B98F7578B1B7D77F222AB835B8B5F8258660726D8F71CB0EC0E5CD27406A35B3C94C48F1A30EAA27BAF55016A6A379118D3F6BA2328322⤵
- Deletes itself
- Executes dropped EXE
PID:1736
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
499KB
MD574c4e2ab0897f762524b65dced4078fe
SHA18b70d71d5b1cd7fd93e600fce349098f1818d73e
SHA2564cc26bcfc53ab82e787a1ce00afe89e08be096fbbd7031928b09d18c44501b67
SHA51274e23966c7a495b81a14bf29f90f25745aefb42adc7906d244334d008e9bc47726ce188d756d55c4fdc98e3b6293fb9f2e336731e56db8e82547e7f0d8f46eb9