Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
18/02/2024, 08:53
General
-
Target
2024-02-18_d256be67cac5c1daef3e87d723e3d79a_mafia.exe
-
Size
468KB
-
MD5
d256be67cac5c1daef3e87d723e3d79a
-
SHA1
7ab5eaeba49013a06a97538d1492b2b44d8cea26
-
SHA256
f29199318ad1d541653707da25a0322712355c2d9c2cc58ee949e4ab76f6c096
-
SHA512
87a8bed8d0f76525e01847299761d7ca0dcd72ab3a761fe5e71cf6c904b30c37ebb9fa8d460b32cbacea9f5cabca5a066108b56e82aa873a8484b9a965ae8903
-
SSDEEP
12288:qO4rfItL8HGXbwrPeWpSCKRGFurt7bWmeEVGL:qO4rQtGGXbMP5pShR+urtumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_d256be67cac5c1daef3e87d723e3d79a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_d256be67cac5c1daef3e87d723e3d79a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-18_d256be67cac5c1daef3e87d723e3d79a_mafia.exe 5D156A4A85C23E506669E633608ACD633C959EDD96438DACF411E1CC8349D53C6575978DF028785189D40AD09629BCFEAFF383121A5EBED262AC017BC24FB2D92⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5280b889459ca8fa7a0d9b64baf97cb93
SHA136633ae61a8d947846c2c8a4a863346df72c0593
SHA2561df74b565d26ffaac84ac58a6ddbd6696ccec16793b71205463d1d66f79be801
SHA51279278b4fa4b0145e66a38b910fa88b645fc2eefe4c6a95b1d6febc51e6fc48f82bccb7a4ac6965960e5443e2c4770146861ad7e1081036706f44a4237ce13efe