Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2024, 12:29

General

  • Target

    2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.exe

  • Size

    465KB

  • MD5

    1f8661fee90345a7b2a278ba645fac22

  • SHA1

    e5ec83da80a506fe0f66ff071bdd35b5e18e67c4

  • SHA256

    06105e3f7323666a3574244d486e40c3b6fd0e820f7899ca6545386a366ca818

  • SHA512

    373ff5c20f482bf7a634af4aa7e023fb3af4872d85955f5f043b93e63a38a9614a5bf5a3d45999ca3f1136ff770956fd8bc335f27869916ab2e77afa4280155b

  • SSDEEP

    12288:Bb4bZudi79Lh5ngomkoJm8b4LcfUHl28SJA:Bb4bcdkLh5Nmr0cfUhS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\67D7.tmp
      "C:\Users\Admin\AppData\Local\Temp\67D7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.exe CF53B08EBCB0A32E95B83261638D916EB253B3FA00C3AC1F4E560549B56C155891EBA0CDBADB5E5CD00B10BD4730CE9042611128435C0997834D66D5FEC8AC34
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.doc"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:3020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2024-02-28_1f8661fee90345a7b2a278ba645fac22_mafia.doc

      Filesize

      35KB

      MD5

      a6b03fc9e5439b7504ba08010a960962

      SHA1

      e93a74f35ac1ed020158642eb1f2087fd31fc7c6

      SHA256

      b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

      SHA512

      decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      8dabfd1f1937fafc8e81d3e031bc34f7

      SHA1

      e48837feedb402a2e1e4f453aaf93a606ccb3a17

      SHA256

      2b3efddc26cb9a79f77fbf33df4a96fc66bb07fd33f85d04b92cbea3eca72359

      SHA512

      aba69352c6782cc99c55db41f530366e73da68a892db72febbf4e271bbc0e1e1d4bddf549fe2c8324381edf66ac03a36701e90966952abb85cf934539af4e402

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • \Users\Admin\AppData\Local\Temp\67D7.tmp

      Filesize

      465KB

      MD5

      9ea4528d06a69dc1f0d26d2b67d4fed8

      SHA1

      6e82a16af7f6fa34b639661f1db4bf50c4520033

      SHA256

      cadf302f982c64a8430214074eeb2f8f8b7ad1f34fd4f0140d29ab257a5f8a4f

      SHA512

      1f6e2fa32ec0f95c623dfd4dd0e801d74c49703bafe4cf9aec21a43084efb93a90b190927fae05993b791567303f315472a5d7c5beee22fd4e75189d6f0b3ab4

    • memory/2552-7-0x000000002F4B1000-0x000000002F4B2000-memory.dmp

      Filesize

      4KB

    • memory/2552-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2552-9-0x00000000717DD000-0x00000000717E8000-memory.dmp

      Filesize

      44KB

    • memory/2552-28-0x00000000717DD000-0x00000000717E8000-memory.dmp

      Filesize

      44KB

    • memory/2552-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB