Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24/02/2024, 07:39
General
-
Target
2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe
-
Size
468KB
-
MD5
b05805a19bec0e5968eb4ac1bcf5b583
-
SHA1
c2961702a128a55a991764614a10002a39280bbd
-
SHA256
e23eaacc9c831e6bc1326470b65acc4558a2f210ca750602719407ae34c375d7
-
SHA512
e82176e41cea63d0695fecf2c12287b6fef87623b06444f07ccc5ae15829ce87526101ab906cb28b1ef1153ce5273d800ac3771da1f7df1979a4a50748d1c159
-
SSDEEP
12288:qO4rfItL8HGjejnzwt9PgN9BQ9W9Kd3nK7bWmeEVGL:qO4rQtGGinM9EQdXKumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe 5D772106C9F241C0B984BFA5DCFBD9E95E300809D64A6248E6F9EB6F3543D03E63BACB1220C7E6BBB443B281DC1CE1B7555D1BF40A043605333BBED61B0DA49A2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD545a25d57998850dff32a23be6f162801
SHA1ed0a5b4bf2e57ea46b6b129ac062419e84ce8669
SHA2560165a455b75ce606b9ba55fd0c6c423417d31f36bb1248002eae3525167bb951
SHA512ae740198e5d9286cef9ee8dae8e1222d8f6cee8a4b5437521658ce6818d4de629887db7bc9ad43fe91228be8439759716a443abe8aa073930bc3756bdb27a963