Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe
-
Size
384KB
-
MD5
1ad07e660e5a4658227789c3e57c04e5
-
SHA1
37fb9b44b2912fb43f9d0ccd1ec764023c3d46fc
-
SHA256
42f649bc493954e50eb17d37fb5fd917272fa224c22d5587edb3cb87c52e7005
-
SHA512
08c225fdc4b57a5ee19e33b3bd74f58f6542d4d6c102ba39ed24357448f6075a7d1d4347358ac039525c68d28fc24f823ae5e4baab81136e3ec3e7053f1dc5fa
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hHRYN5EYvlyVjvhCQkLRvJAYLQagK7e431tRZ:Zm48gODxbzAN5NsVVCQkYYSKiEhZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3032 3D47.tmp -
Executes dropped EXE 1 IoCs
pid Process 3032 3D47.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4044 wrote to memory of 3032 4044 2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe 85 PID 4044 wrote to memory of 3032 4044 2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe 85 PID 4044 wrote to memory of 3032 4044 2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe E808D9749443B5357AB45EF883466D8A2FBADD746442366F3EBBD2BCB7AC2579AAE5D67BCEDCE7551183AC1E2ACB3850BAE913EFCC9DA808DC37F3AAF6B92C972⤵
- Deletes itself
- Executes dropped EXE
PID:3032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD505d9abd944258f5ffe872f9f56647877
SHA191e5ad43454b46231522e5b157bb819783f7c9ae
SHA256123aa12a089fe7741b31e4dcdb22318a704f85f0c84ae9231aa4bdfc401b0512
SHA51271f9ee275d5a9873095b2ec597cf6d58bee6303dbe8ce1672430ea1dfb0a18b4bca144b010f22e49801e37608a3a9eaa539994e0728f37c0a0a71f9aa5c18122