Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe
-
Size
384KB
-
MD5
f017bc72d84f222bc27d247168c039db
-
SHA1
62ea3fc5184f7a3f0609ff14a228328227882a1b
-
SHA256
e2ce7abb4716f2d100162804f3a2307b14baa01c79689944e03a4537b148d710
-
SHA512
9c5855f7719c86902f25f56c62709bf69f9262e0aa911f8f02f4863e179993ea0b0e5fc10073b47c4d909d85c8fe1449963c78e26412290a31cfab8d9284807b
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hHwr8COo2OA9gmY4B9ilcDJzSAcZ:Zm48gODxbzuo3O8gF4LilAJzdcZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2940 116E.tmp -
Executes dropped EXE 1 IoCs
pid Process 2940 116E.tmp -
Loads dropped DLL 1 IoCs
pid Process 1776 2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2940 1776 2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe 28 PID 1776 wrote to memory of 2940 1776 2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-02-28_f017bc72d84f222bc27d247168c039db_mafia.exe E79C23420133B1B156E86D0937BDFD427CEC2B82BD88117EE4B058C585056B6074C3B7C5A985D4309BB308D280F4BD5C715166F312B969C146AE2DE3DEC80BFB2⤵
- Deletes itself
- Executes dropped EXE
PID:2940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5e4034b8b387a757b866dbd51a4727b3e
SHA1d353aebbe164bf846fe9920583e113387a068dae
SHA256f0ddc0c8ef8460ace6d3be6263689c3aaf6384ca0349025c330bb9533dcc37ca
SHA512767c97f402b0eaee4ba4cb8957f5340cf41e6d72f2cb20bf7ed70c1859cfca2e80033f9030cd609829930146c4a77abe836447a838c946b67386ab87bfbb9abe