Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
-
Size
486KB
-
MD5
b8c4dec165547797b48381d1bbc1ef01
-
SHA1
f2ec8892c07cac996f9286b1b9e55b8bc39cd54c
-
SHA256
73d96340589018bfa31738051829b3a14c225456eae382a6d2658ec6acada5a9
-
SHA512
21a5a1f28c96208eb2fa9536a5756ecc83d0972b95f8baac8e85099f50e2376a02566bfdc41124a7411416823f641e8a25849bd416b6e6afa5cd50cd68951178
-
SSDEEP
12288:3O4rfItL8HPkJScOSjY28oo/dcktMufK5t9b7rKxUYXhW:3O4rQtGPZwjYBPdvo53KxUYXhW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1020 606.tmp -
Executes dropped EXE 1 IoCs
pid Process 1020 606.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2820 wrote to memory of 1020 2820 2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe 97 PID 2820 wrote to memory of 1020 2820 2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe 97 PID 2820 wrote to memory of 1020 2820 2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe CAA377505B5195D9CCB27F0D8AC493E9913D17A09AAA58F489F940F31C5B02274EFEBA632775D6D7CB471BE33966B8E1A754F4F6A54844DA88C41F9F4F89F2CA2⤵
- Deletes itself
- Executes dropped EXE
PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:1156
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
486KB
MD5427b74fd5cb8d37cd478f6f954ee1ba4
SHA12c2628e62dcd92c0b0ca1de6e63119285372891c
SHA2561af16065d03fa2aedebd0b0b49736f46b1212fbf2b537945f1d86e7f456612c3
SHA512eb8bc47f0e3a3fcf4c24370e172a335b8c41d79a0401df46e607a1c9acf7b5ecb538047ebdd030969dceaa7d210694a913e8b1f303c2bd1a70ba65f80c779be7