Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe
-
Size
384KB
-
MD5
42586da29e2800d72636a9ab94829310
-
SHA1
492949ae7cbe9f97f81497bb6a4e5f11ababdf1b
-
SHA256
d6afcb007616e0384e20f21ab9b690efbab4beb186ac2168d08f5f7102021911
-
SHA512
664ee2fec4f975707a2593056b8b1849487bb100800fd90f8c7891a0e334afbdb0d29a3c91717d6ed54d499d2e9a13d6eb031c96d363d81a04877fb41abf2aab
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hHaKkUIqnYUbsvxl9Up4IC9wy42sZa0OWaXZ:Zm48gODxbzgKkPqYrvnOC79RT6aXZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2936 5532.tmp -
Executes dropped EXE 1 IoCs
pid Process 2936 5532.tmp -
Loads dropped DLL 1 IoCs
pid Process 2108 2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2936 2108 2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe 28 PID 2108 wrote to memory of 2936 2108 2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe 28 PID 2108 wrote to memory of 2936 2108 2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe 28 PID 2108 wrote to memory of 2936 2108 2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-03-06_42586da29e2800d72636a9ab94829310_mafia.exe 0038A18C735A9839EF63DE798E77E455D4646B43CBF54FD5E5E4764BA979F263FC14339E2536C4C0D760E8991EEAE93206995ED4D04A1AD0ABEAF7AB2C2E48592⤵
- Deletes itself
- Executes dropped EXE
PID:2936
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD58da72daf24dae7232ce3c3b6dc8b04de
SHA10c0a8dbc0fb3ef4feda357cc7c0addb03c4a308d
SHA2562b4f2ffebac34b96a8a3ee28ba684d962d1c320bbc6e762671e4100121a955f0
SHA51277bd790e65ed959a0801eef07c3adbef8ce3cdd3db985946ed5bcc3ebf10aaa28c4fc8ec27ca1389d6e59c427aa98b2fd2afeb31db40427eec2bd9c94f28f5c3