Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2024, 17:25

General

  • Target

    2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe

  • Size

    384KB

  • MD5

    1ad07e660e5a4658227789c3e57c04e5

  • SHA1

    37fb9b44b2912fb43f9d0ccd1ec764023c3d46fc

  • SHA256

    42f649bc493954e50eb17d37fb5fd917272fa224c22d5587edb3cb87c52e7005

  • SHA512

    08c225fdc4b57a5ee19e33b3bd74f58f6542d4d6c102ba39ed24357448f6075a7d1d4347358ac039525c68d28fc24f823ae5e4baab81136e3ec3e7053f1dc5fa

  • SSDEEP

    6144:drxfv4co9ZL3GBGgjODxbf7hHRYN5EYvlyVjvhCQkLRvJAYLQagK7e431tRZ:Zm48gODxbzAN5NsVVCQkYYSKiEhZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\3D47.tmp
      "C:\Users\Admin\AppData\Local\Temp\3D47.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-11_1ad07e660e5a4658227789c3e57c04e5_mafia.exe E808D9749443B5357AB45EF883466D8A2FBADD746442366F3EBBD2BCB7AC2579AAE5D67BCEDCE7551183AC1E2ACB3850BAE913EFCC9DA808DC37F3AAF6B92C97
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3D47.tmp

    Filesize

    384KB

    MD5

    05d9abd944258f5ffe872f9f56647877

    SHA1

    91e5ad43454b46231522e5b157bb819783f7c9ae

    SHA256

    123aa12a089fe7741b31e4dcdb22318a704f85f0c84ae9231aa4bdfc401b0512

    SHA512

    71f9ee275d5a9873095b2ec597cf6d58bee6303dbe8ce1672430ea1dfb0a18b4bca144b010f22e49801e37608a3a9eaa539994e0728f37c0a0a71f9aa5c18122