Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 11:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe
-
Size
384KB
-
MD5
ebaef5d742cbb88cc370adb075f550e2
-
SHA1
d44f57ecfc472f6d085b432129db289897d5b6a9
-
SHA256
2bca2e2796d34b19a30f625a1fedc8e8315dcf9542bba8a35e5b6a48b64aab74
-
SHA512
084acd64fdb0752b557b6a3a23714ab412cfeb2d69aafdc83b2f4e06d0f118d687ec3f789828a1d8d276d1978d7dea2acb4b83dd13c19ed8f023dab49c6ed512
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hHM5T3hMZwh4m0j450pxQUXuw92AxylMCZ:Zm48gODxbz+WwZ5Suw92ftZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2232 703.tmp -
Executes dropped EXE 1 IoCs
pid Process 2232 703.tmp -
Loads dropped DLL 1 IoCs
pid Process 2540 2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2232 2540 2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe 24 PID 2540 wrote to memory of 2232 2540 2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe 24 PID 2540 wrote to memory of 2232 2540 2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe 24 PID 2540 wrote to memory of 2232 2540 2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-21_ebaef5d742cbb88cc370adb075f550e2_mafia.exe 6E1C4321AB44AE5D6A6986CC57EE4B86D07D770318014869D9CC89158FE64B0573A7178E9EE5B580D8ABDD8228F6938FF83ACDA6FBC3E483B74BC45E864E993B2⤵
- Deletes itself
- Executes dropped EXE
PID:2232
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD590833e525db34811a43088e4baedf4ce
SHA10b3930c1b1f1d170c561a913efd1a4314b477e7d
SHA2564ba69e9c761c7bc17464a81290765c20352955b3c96a2d9fa165e28ba8159362
SHA512a89a5b9a760097d51388d6ba90d922cebbf82cff351cfa68a63fda9d0877f15f61bcb08794059fe0ccdae8383ded8a3493526346106176e8c749e44f77044771