Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe
-
Size
476KB
-
MD5
bd97dff96636e4a80726e836f950a648
-
SHA1
610a622e6d9db653a82899daaddbf0efd0812a03
-
SHA256
8878f759d9c8e2cc2463d0ac42664cc6bf61869899d8e695bdca92e121183292
-
SHA512
f17556a2f3022c3bcfd070d91bf67d27ffec459cf6eeb05392bd692f7d2065ce70eea1240da52bab76e2bcd92a01f572210106ed037e430c52ceec487c96e66b
-
SSDEEP
12288:aO4rfItL8HR+0QEPjQCCG2K60quFwi0koIV4Q+7K9wlsDpVFd:aO4rQtGRrDPj3g7CkkoxQ++9wlsDpVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2596 6D34.tmp -
Executes dropped EXE 1 IoCs
pid Process 2596 6D34.tmp -
Loads dropped DLL 1 IoCs
pid Process 2040 2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2596 2040 2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe 28 PID 2040 wrote to memory of 2596 2040 2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe 28 PID 2040 wrote to memory of 2596 2040 2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe 28 PID 2040 wrote to memory of 2596 2040 2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-17_bd97dff96636e4a80726e836f950a648_mafia.exe 5E18E6BEA3C019FF0032B32C0C0008DB1D0EEA05AB30F22361CC051540971E5E5EDD9CE5CE0A7DBAA57E20F031D7F66EEC21A148A3003D36CE50F56B6E18C1342⤵
- Deletes itself
- Executes dropped EXE
PID:2596
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD51325f7ba117141df4c54335c9d72945b
SHA160336ca36ea6fb3dbb45669b8bf64b4cd3d61acb
SHA256ad87e8b4268357dade5470ca7cf9c57a272802e3bc40661d704d8e547b806fbf
SHA512f4d3a414eccf5491d8903f31696090bcbf6cb0cea3fcc1428fce895b4335cbee10dbf42a43e454a36540c273df9faf4a503c78613e7a0ffe611e93199cbb5366