Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/02/2024, 11:55
General
-
Target
2024-02-18_ab0d032c3f232d48a76bfa3c8f9ce270_mafia.exe
-
Size
411KB
-
MD5
ab0d032c3f232d48a76bfa3c8f9ce270
-
SHA1
4f538259110234bcdcefaa955101929852aba298
-
SHA256
a105c6c6f6d4860e368b95252a648d5e2a8e3b4aade9e0766f4f1ecd5364acda
-
SHA512
a0c463932ea9b33feb1844cde5ee761bd0af8b8a2e962d80315204b63a8401c4637828e19aa8d3e62ec1e38a1d790e4fa4ec05d6559058b800707e92b06ed54c
-
SSDEEP
6144:gVdvczEb7GUOpYWhNVynE/mFqLnfb119g9xMUrc/sR0wbVqHI:gZLolhNVyEF119gEUoUKUVqHI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_ab0d032c3f232d48a76bfa3c8f9ce270_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_ab0d032c3f232d48a76bfa3c8f9ce270_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-18_ab0d032c3f232d48a76bfa3c8f9ce270_mafia.exe 6E3D67F9FC11BB81178F48F6625DAC418CAB45534171A987C68ADBE4AD527E451142AA02B3236228547161CE9719BE5C0308C08D4533F2D91FB5BBF2FC4F89F52⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD58535fd9c9bcb228e455ce15c059e58f5
SHA1b888fe6ac4a6d712c63ef410a5be95dee456d0cc
SHA256af25a5a15bbef7876d3298129a8c37dc476b8deaea5ad01ae45a1a4a42243e6b
SHA5128355869e21d9810c63bbaf7966f110e5b99b8ac7abbb110272e77785ef4fffba2ac1429fa4747998e1b3f6570f3357968a823f1d42f11d9f50a0e75401330d0c