Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe
-
Size
468KB
-
MD5
0accd1ae5a09213eef2f7a124ab5d459
-
SHA1
03591210b40453da2c79a281e9e627be696ac351
-
SHA256
80233de6e11d544ddedb00d200ad70a37691889d8a79afe0225b3660fcc4cbd9
-
SHA512
6a462a046a347573c688b29e99127e4ce3920fe48f13279cda984db700c0cf1b1e649737b5d496086e85e9e20a44396157768f1e53b0c68ecfa6a40c729a9479
-
SSDEEP
12288:qO4rfItL8HGxfVX5m32jg+HiyFTNVuTtxsg3xuv7bWmeEVGL:qO4rQtGGxlQ32E+HfruTMMuvumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2240 59D3.tmp -
Executes dropped EXE 1 IoCs
pid Process 2240 59D3.tmp -
Loads dropped DLL 1 IoCs
pid Process 2004 2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2240 2004 2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 28 PID 2004 wrote to memory of 2240 2004 2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 28 PID 2004 wrote to memory of 2240 2004 2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 28 PID 2004 wrote to memory of 2240 2004 2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-03_0accd1ae5a09213eef2f7a124ab5d459_mafia.exe 2EFEE52928CEFB328FC4848AC35A4C3AC053EFD0C5F274D15A58633659C48ECF3F75DF59D479E46A3D8C9D3CEFC4E5B5BF50FF23B94275EA713A71E127840E442⤵
- Deletes itself
- Executes dropped EXE
PID:2240
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5360f6b0c76874911bd85e3ebeb61495e
SHA1b06f593491fb87d5e7cd7134040e6d1ecef7f9ef
SHA25693b38bbe514015c561f850c57af6354b536f7c8fcebb521f8dcb53c4659d296e
SHA512e3fe784e0929b27ac0e57842896e9405f3e877f234f0635bdaaf313fa0d2380b8540a8cf34a18318a1549b16bed1d002bfca898e252dbcd3a5170716969e4cc8