Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2024, 09:44

General

  • Target

    2024-02-23_75574261191afdf6baeb4a1d4c260999_mafia.exe

  • Size

    290KB

  • MD5

    75574261191afdf6baeb4a1d4c260999

  • SHA1

    f4f498524f692b232bf5aab4d697390a6b02c791

  • SHA256

    012b75fd67dd78645a74b076f4279db286cd9f9b0afd315186b57e72f5d8fe2a

  • SHA512

    7df552acf4e57f3fbed3e4419d51e73f35e9fb9bf5ff87855aebb85c0efd697409a5bfdea29cd76b5f4b48d7a0fc8fa9f8081dfb873c44df4f521076c9bf65de

  • SSDEEP

    6144:Ec4Ub8G98n0021valv5ewibh8HOlxHUbx1LqrJQU:Ec2GS0021vUv8oOlNUv2rJf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-23_75574261191afdf6baeb4a1d4c260999_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-23_75574261191afdf6baeb4a1d4c260999_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Users\Admin\AppData\Local\Temp\n1324\ins1324.exe
      "C:\Users\Admin\AppData\Local\Temp\n1324\ins1324.exe" ins.exe /e10390497 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\n1324\ins1324.exe

    Filesize

    265KB

    MD5

    4c24a9e76a700931ae23e212519593c3

    SHA1

    d738435c7d5d98223462e6b4dd97e1081f911e97

    SHA256

    75912abe46cabda79f285ba2b0d70c8aa31eae564886d2f483f3e325379b67fb

    SHA512

    d48038bdd5e06761c45b711cf7dff1c5b6e56e5cbc230041fb16e1f3418235809008ea3545375e02b48b0cca1857348ea23fd4fd35165e72df9a9956b225f12f

  • memory/852-14-0x00000000004B0000-0x00000000004BA000-memory.dmp

    Filesize

    40KB

  • memory/852-15-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

    Filesize

    9.6MB

  • memory/852-16-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-17-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

    Filesize

    9.6MB

  • memory/852-18-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-19-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-20-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-21-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-22-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-23-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

    Filesize

    9.6MB

  • memory/852-24-0x0000000001F00000-0x0000000001F80000-memory.dmp

    Filesize

    512KB

  • memory/852-25-0x000007FEF5BB0000-0x000007FEF654D000-memory.dmp

    Filesize

    9.6MB