Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe
-
Size
412KB
-
MD5
71d790d0956e8bd191c97fbb5a146e3c
-
SHA1
1a7f1ba12df2e40070976724f26150d7e9ff7ef9
-
SHA256
adb822f8a58310cfb521fed0f2b1801bc326ee8e93b14c79cf99e8663dc39bed
-
SHA512
71cfc5629d3948a93548e3a5a910292d1a0c65773e0686d4f93c9344f2c869078df27d037770760e2abcfc646be7a38acc5154815df148bf3b297524eee47a21
-
SSDEEP
6144:UooTAQjKG3wDGAeIc9kphIoDZnXkxPAnZ2lYBGjN330J8z/lJ9C4HpP:U6PCrIc9kph5ZkxPCVG9R/lJw4Z
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1900 192C.tmp -
Executes dropped EXE 1 IoCs
pid Process 1900 192C.tmp -
Loads dropped DLL 1 IoCs
pid Process 1724 2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1900 1724 2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe 28 PID 1724 wrote to memory of 1900 1724 2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe 28 PID 1724 wrote to memory of 1900 1724 2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe 28 PID 1724 wrote to memory of 1900 1724 2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-24_71d790d0956e8bd191c97fbb5a146e3c_mafia.exe 45B0AAD4B101A8D07413F65451F601AB365280C675093EF80693B4655E9E5A6ECF68FA67F3E34872A48E14A0D08F35AA2D973A03E0690414E56AE4C97BA4183D2⤵
- Deletes itself
- Executes dropped EXE
PID:1900
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD565270e805ea588853dabe0e2e0d71232
SHA1aaa5087a80d780a393fe49ec7417cd3d49f2194f
SHA2568d5c21e63e9fda95b4cd8f0ee89e4a7c1fa3c6d76a468dd60f6e1d88ddb4f171
SHA5127821b8ca67639d65c7bf2fa44363777735b5a48df9afd182f776801dc95084afb9b09d0d05e3f3fc38c57e66de06c65e4dee49246420a0d374aabc9159f66ac3