Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/02/2024, 01:43
General
-
Target
2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe
-
Size
384KB
-
MD5
0baf306dc83beb8b9860beb7d5ab9190
-
SHA1
afc73f7148da72dca8d9dbff5eb856de830cfb4b
-
SHA256
403f6551424f3b464473e0893b927d531ad7d04225938c5a4813be9a62d594ef
-
SHA512
35466fffad0d13d235e6d81090868f6ce3aba6f766f41d976dd9c708d9bb28a8700536d7967dade403ecfd1891b49ebeeb5e05dd0d09215e71de735817b527fa
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hHc9ql4zHhUMl5F6HOTLyB1HCv7NAfCZ:Zm48gODxbzWkgBUqFkBFCv7NQCZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-28_0baf306dc83beb8b9860beb7d5ab9190_mafia.exe 033930DE879AE775C7CAF4EC98A3182CC75791B5DE6206ED7784773666EB66C5791D701997B9320C6A97DE864FE847F08713F33C46383AA4BCA2F2B4FB515B052⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD54c428b01c90f1f3c13c2390600c7292b
SHA180b9cabb7375bbe2c85929de792e05b559f3ed73
SHA25612eb925d49d19a4b868e41b6761e61fba107b034628bc2e609bb1b2e0f7c084b
SHA512cdafee1a8935ff0df99bc84e7ea30020561f704f8d1ae6614287b1dccd715d62b49e05a3ad618c58a27a0eaaee84b9c1fa45f04a2097d4469388de65c715d515