Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
24/02/2024, 12:51
General
-
Target
2024-02-24_f7f4bca95ffb498e0ffc5efe1c57c121_mafia.exe
-
Size
473KB
-
MD5
f7f4bca95ffb498e0ffc5efe1c57c121
-
SHA1
85a9ece8f5b70f54cd00c4104f5db93fc56e7be0
-
SHA256
4cc9accc18cb2786528d94817393b1d3d4d01dc303c88bf1ba803c83564f0259
-
SHA512
2c2e950bfa809ad017a29190664c721dc2629c6ecb84efdee82af99ad7f164f3bff36e66e967be856dd3c8b700f82f29b3c8c46d93a6096a0e8acb58187792fe
-
SSDEEP
12288:Nb4bZudi79LKFafjjZYbVX0yMRZzbkCg3SJoRs7A0a:Nb4bcdkLOarjZYbGHug+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_f7f4bca95ffb498e0ffc5efe1c57c121_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_f7f4bca95ffb498e0ffc5efe1c57c121_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-24_f7f4bca95ffb498e0ffc5efe1c57c121_mafia.exe 9E35D048EE01DD34A3829A67BF8081A5E378C32F03E724F8F7B881B966B36055BD853E602E96DE2F3A65FBDAC4FF70F4FC424C884B1AC13F108D75A291BE031F2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
473KB
MD586336fd7df849c43516ded13e4268db1
SHA105f205d2d5aa220073d53957c1632b191a96aa72
SHA2564168f840c2471b905c9ae619ad5181a831f1ae816e5dab42f790a7afb71ed9c9
SHA5125bf9f5694dc4eaf49bb2894bffb001df0344a13579de916d69d0e7b28dae47dee6ded89f5c3d422dc0a6e172b00e505139e2998ec28a385b900cf9ddb50d2739