Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/02/2024, 08:33
General
-
Target
2024-02-25_c58b1590950fe75abaa8fa13692e3e6a_mafia.exe
-
Size
443KB
-
MD5
c58b1590950fe75abaa8fa13692e3e6a
-
SHA1
a71260dc641e27224d1ccf4952bb38cd9cbd1b88
-
SHA256
7e2ad59834e5c0eeff50499a5d8063f41a12ef414d726be74b9923f5c36fe1bf
-
SHA512
2ac3ebc11825d62ac9ce39bd23c3a57f5867ae127742f2db15ba7d1ff60cf730c272eead0e9d0b8740bee234531a95996d88a728d3ed2a573b41ea88314952de
-
SSDEEP
12288:Wq4w/ekieZgU6sre55cx+CpN0VO2SNGYmkdKjKlMa:Wq4w/ekieH6eqe+vCdKjKP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_c58b1590950fe75abaa8fa13692e3e6a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_c58b1590950fe75abaa8fa13692e3e6a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-25_c58b1590950fe75abaa8fa13692e3e6a_mafia.exe 519AEBE7E3A433607E8B3575F3381B3206843CCFEF71890E4DF7B2EA26E6D5CA3F17C5194852E1089C979E7D8D082AA7A11DA7DA8618E92B5D01595FF903D9F22⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD5e11cac7e01deed4506f86a83854308f2
SHA1887ad77f7a2e300facbfc5e51335ac64e18ccc7f
SHA256d0ae34cb986543a2399f1184680fbf7024711d0ddcadce493544a22b59fc515c
SHA512eaae6012bb106e5558adb94d20302eabf4238645a161c67b3f12939eeeabc9d6424c88249fb2152fc934de3c2cc7ec6c298e148ad099cf8cffad09bd712b77ed