Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe
-
Size
414KB
-
MD5
fd3c6d8e3d55d0cc71704dc098b56e1d
-
SHA1
518e7ab901f135699f0f3bf1bfd805b632b3ce26
-
SHA256
8fc3e5401979665fe35d8b043e11cdb1450d304e15ed99de7bbb12a41b5ef4b1
-
SHA512
d3c11553dabbc6d079e8135fbf4f3d2d965d735a12c60fb31097fd47784d7a675d5c43b8076402a9aa556d26afb714f2b7258818ac1d01b287848f10be4e6b66
-
SSDEEP
12288:Wq4w/ekieZgU6/IhMElxtTQqVl/yn5Pil:Wq4w/ekieH60MElzynY
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2088 3228.tmp -
Executes dropped EXE 1 IoCs
pid Process 2088 3228.tmp -
Loads dropped DLL 1 IoCs
pid Process 2208 2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2088 2208 2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe 28 PID 2208 wrote to memory of 2088 2208 2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe 28 PID 2208 wrote to memory of 2088 2208 2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe 28 PID 2208 wrote to memory of 2088 2208 2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_fd3c6d8e3d55d0cc71704dc098b56e1d_mafia.exe B1129A71D72FDCD29522ED4276298E6662229D806DA02EEA829AF6F726D49901B3AB960CAD5A93EE399AABC1F3F77EABEA106B73BA3081D47B4FB4D3B79E5F6C2⤵
- Deletes itself
- Executes dropped EXE
PID:2088
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414KB
MD5f433c066aa8cf14de5e4d3b6ae982fb5
SHA13e1c47a401aa709f20883e178c3b92a6f82c9555
SHA2569e314a84983c81784a9a792d7fe2efa0e70cf818f5406881bb4cd72990f6040d
SHA512e20033ee4301a6bf66b929dbfaa35ea0171b74dd6a4f8f262417e1d48ec487b39d0b5bf99020cb37604a13c653cdb14b167b187a06bdb14de638116ea2b955f0