Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe
-
Size
468KB
-
MD5
65bc2eaffeee862960527d73797f72a7
-
SHA1
cd10021b1cd6a7dfe5d1ad2d9018f0be09bf5e34
-
SHA256
b563ca9ac073114f83beaef565b33edf94cf5d07654d9be870bf14939f266e77
-
SHA512
1a7fd6865e2c939575af67973e126b8cc6432135b22f3cdbf6f80885860515478da24f750a8c1f01639b522369bef44c7739d81206b3491361877a730c279f6e
-
SSDEEP
12288:qO4rfItL8HGZoB5Kb8SK9kLS6BMrCRZpjk7bWmeEVGL:qO4rQtGGFb7LS6BMrqzkumeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3184 5EBA.tmp -
Executes dropped EXE 1 IoCs
pid Process 3184 5EBA.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4488 wrote to memory of 3184 4488 2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe 92 PID 4488 wrote to memory of 3184 4488 2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe 92 PID 4488 wrote to memory of 3184 4488 2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-28_65bc2eaffeee862960527d73797f72a7_mafia.exe E11F0A4B46C1FE57C39C124E74CE416D85F9D0B0B50073ADECFB3D37EEE7EA5C238E0E5EDB06CFB8BFEFE146A71E984C32AB7238193D83DE23F90C3855F460522⤵
- Deletes itself
- Executes dropped EXE
PID:3184
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5e70509aa443cddd0fecb1f6b24e40825
SHA14d73ee7338d05c6c4be69fa65d1b3988b5b85c10
SHA25600257897a9085d55b7ff76a52b4b0e4407c07755a8838a10bbeb13c18e7b13a3
SHA5122b493a6e40ace17fc302fcd5a2845ff4b3522955c8fa6d0b7b09cac70dda23a0c4c6944722a6abc2f99f1774b34e67b301f72bcdabfd8ee08b9d259b17c98c34
-
Filesize
140KB
MD5cf8aed3fddad44c35176bc651aaadb34
SHA19cd0b8c31cb65922d04e492514a183fd9e2f1d9f
SHA2564567026100f38c179b463039d1696276748ffc81c6e8ad88fe17b43740b9849e
SHA512ba0b1a202ae725d5036fc352f60b833c3beba25c1d5ec5a01fc69676cbd9216b7ac1fbc08c3df4f73316764fb739a1888ef58ae91c425b217b1fb86527c1974a