Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 08:18
General
-
Target
2024-02-13_da297bbe67d01c1e39386d5917989ee1_mafia.exe
-
Size
476KB
-
MD5
da297bbe67d01c1e39386d5917989ee1
-
SHA1
fe9cc2a72b7f1394578f8b09885775c868328696
-
SHA256
d069050ef2cfe73c3f79ac34da59648668a577bfc4e2118f51fac44c83b390f1
-
SHA512
2f1da88d411bc39cd08dddd4de7c3b70e708e00e1e332c1ab5714f9a3609180a8a632ae06a9b46337ac3ae3d596fcfb8987b48187f2e04f1af1006b66f3b29f3
-
SSDEEP
12288:aO4rfItL8HRuGW2Yd9QQgny2KNG7K9wlsDpVFd:aO4rQtGR3eWVK8+9wlsDpVFd
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_da297bbe67d01c1e39386d5917989ee1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_da297bbe67d01c1e39386d5917989ee1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-13_da297bbe67d01c1e39386d5917989ee1_mafia.exe 47853E5C1B6F913C2DB86EB4C4D231BEAD61E773787FEE4FCECE8A8B8EDAB29B98CAB71081ED8799CA0B23EE6E2D2F3296EC64F9068E319CD73DC427066918DA2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD52cb7924d533f044967ad875f12895bb6
SHA1c55c6a3683efd07c8edac5567607bf6f06d2ce41
SHA256c7b6f2c5a4bf42b8567570a55e0351006cd942726a15edbddae6a6df661595aa
SHA512c824a57a5cb14fcf27de79dcbc4f5ea077fafb2c26f71cea844ba11bedb0ff0705bc8341dca28bc264bb45ca000513b2d70eb339218261744fc4c5bfe39ebd52