Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-01-27...ia.exe

windows7-x64

7

2024-01-27...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 06:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe

  • Size

    428KB

  • MD5

    a6c93dcb2e74948d2076b8aa02c0c11b

  • SHA1

    5c7a68c37a91719e20825d18d8bfb0b1b1871926

  • SHA256

    3bf8708cce46d37458aab1fbf830ee8ff92156bffc3a17bf87e081d08fbe592d

  • SHA512

    83e80a7152308b92023a8df1a64f7786c607fceda31165c024a8009fcc864ee2b2cd638540955f21ac9f22dadfce4b0db1a5f96c80f3d518872dc47b73e4defc

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mFvANrBWE4Hwe7AHHHon5bcRFxyWqACH3JJqHR:gZLolhNVyEyAlBb4HwHnc5QJOH3JJqHR

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\60D5.tmp
      "C:\Users\Admin\AppData\Local\Temp\60D5.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-01-27_a6c93dcb2e74948d2076b8aa02c0c11b_mafia.exe B67A3CA6CAFA8AB1064A62807FB15C22B77AE4B9730B1C426D1FE35E6CBBCE0CF3BF21FCBE41351EBF2F88D4A77EFC020B0F209209A17F29DB8E13836EEC2DE7
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\60D5.tmp
    Filesize

    428KB

    MD5

    8017d4fa6dec9e0a3b75c53c46a397ed

    SHA1

    f57b5fe649e3efc7a8ca94a2d1e8abdc2353c082

    SHA256

    62ca02d410b389b19cb619f3997758b48a5f73e3a391ff061dd2c54e28629cc7

    SHA512

    de231b77d3db2542fb1a6bd7e0291757820b284898d7148891f7edffd19d16233787d71a4d47c13630f6e9909ee359960ea9f9eb11b6ec06f193c9cd86265575

    Download Submit

  • \Users\Admin\AppData\Local\Temp\60D5.tmp
    Filesize

    153KB

    MD5

    de7e8f1d3b9b350de34c9165e1a00ddd

    SHA1

    08d68952ae7cb0830c4cc68b82dfbe1f37d461de

    SHA256

    0a35aba8576f8c647359bd14616bd4c4192aa0d8b14ee5e121433365b0f23b69

    SHA512

    d731c6696430fc9494af39771225e17f2de14e7e2a6cea6c5d585bb66b14c120c22f1bb041bf6a5364ec5a4e0aa3d9037ac8ce438e2ab27fa870fc98422a31cf

    Download Submit