Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe
-
Size
468KB
-
MD5
b05805a19bec0e5968eb4ac1bcf5b583
-
SHA1
c2961702a128a55a991764614a10002a39280bbd
-
SHA256
e23eaacc9c831e6bc1326470b65acc4558a2f210ca750602719407ae34c375d7
-
SHA512
e82176e41cea63d0695fecf2c12287b6fef87623b06444f07ccc5ae15829ce87526101ab906cb28b1ef1153ce5273d800ac3771da1f7df1979a4a50748d1c159
-
SSDEEP
12288:qO4rfItL8HGjejnzwt9PgN9BQ9W9Kd3nK7bWmeEVGL:qO4rQtGGinM9EQdXKumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2348 4100.tmp -
Executes dropped EXE 1 IoCs
pid Process 2348 4100.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3944 wrote to memory of 2348 3944 2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe 38 PID 3944 wrote to memory of 2348 3944 2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe 38 PID 3944 wrote to memory of 2348 3944 2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-24_b05805a19bec0e5968eb4ac1bcf5b583_mafia.exe 5EF2C5542FAD5FE9E2C82CE23303469D0BCD6DE05153D471D245F91036FDB5486970924358AE33DB65129E504747B77CD1EE95FA52612385B7676BBB8E506B472⤵
- Deletes itself
- Executes dropped EXE
PID:2348
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD59409fe3a3a5915d0d7d4b8df74c1f5f6
SHA15ad7ef0cf9877fee78413946fd925058c7c4ee5a
SHA256ae7cb3f78208edf636c291ebfd622da0ab6f75ef24b9215c4b5e6c571bc3155c
SHA51216fa9e9d38164a007bc46752ab988d877a3644f317370b0e07521a217452ec0b67feb6002a363f23577fde79cd394f849e565b236645d63d8e7ebb48f81264f2