Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 06:38

General

  • Target

    2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.exe

  • Size

    465KB

  • MD5

    499e5b8cae40a9032bf333f3aa590b25

  • SHA1

    f35b686d758760ca0bc5180f57aa983e9541d5fb

  • SHA256

    ac3b8b5add3595d3e15691e927183861ba987ede3034dd901dae7f2b0db2540c

  • SHA512

    f53e83a5e803bc2d954af1675c33d5d72d3adf4b0f9b8ecf882cbf1cfd2a9ebd11cb24fd7ca5b026066d4798f52f157a9355b9e6ab99d179aaa99e65205eeb4d

  • SSDEEP

    12288:Bb4bZudi79LF4wjKo85WXyPdDGch2xLg3yDjEA:Bb4bcdkLFrj85QydDzh2xnv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\1027.tmp
      "C:\Users\Admin\AppData\Local\Temp\1027.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.exe 51218F1A84ACD0D24DE24ABE037BA583C2840B25D13E2EF19DD90F1F7BD77E3912F8EB1B09A4C750F35F4C45396CC64C91131CB1C23B2CB2A18BE52829279D9D
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.doc"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1027.tmp

      Filesize

      465KB

      MD5

      a5a106a2591389ccb1fddab9ffd9771c

      SHA1

      832b486fc7c6894c1fb4c832872d7d9aae1e7a29

      SHA256

      9d294b458b751980bba4184fa8f6fb9e2d7e8962459d0682e1d35ff4f03fac62

      SHA512

      34cc34fcfeb42d97c9c40d214c460592270990406d3f0903a50010e9269c82131e3193cb5999e776c65d123f39233114021f72f70c1ffdab1cb2ff01b80ddabe

    • C:\Users\Admin\AppData\Local\Temp\2024-02-23_499e5b8cae40a9032bf333f3aa590b25_mafia.doc

      Filesize

      35KB

      MD5

      a6b03fc9e5439b7504ba08010a960962

      SHA1

      e93a74f35ac1ed020158642eb1f2087fd31fc7c6

      SHA256

      b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

      SHA512

      decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      7f763811e0ab0bb1a604d007b8354838

      SHA1

      44e866bbd1f8a2470ba9847093d41ab264480f87

      SHA256

      e9812dcef309cab42dcfa50498b86dbfd65cc53c4d88d694e89dfce47b46f4ea

      SHA512

      56905134110a054da6d6f77542c3880727bee8dda369add8d59fe686a85ec467b3ca1bab0323cd0b8f3ec2a58f59fecc2fdd0a4bdbc7db6de4e978ebd1537ccb

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • memory/2040-7-0x000000002F571000-0x000000002F572000-memory.dmp

      Filesize

      4KB

    • memory/2040-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2040-9-0x0000000070FCD000-0x0000000070FD8000-memory.dmp

      Filesize

      44KB

    • memory/2040-28-0x0000000070FCD000-0x0000000070FD8000-memory.dmp

      Filesize

      44KB

    • memory/2040-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB