Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 14:36

General

  • Target

    2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe

  • Size

    486KB

  • MD5

    b8c4dec165547797b48381d1bbc1ef01

  • SHA1

    f2ec8892c07cac996f9286b1b9e55b8bc39cd54c

  • SHA256

    73d96340589018bfa31738051829b3a14c225456eae382a6d2658ec6acada5a9

  • SHA512

    21a5a1f28c96208eb2fa9536a5756ecc83d0972b95f8baac8e85099f50e2376a02566bfdc41124a7411416823f641e8a25849bd416b6e6afa5cd50cd68951178

  • SSDEEP

    12288:3O4rfItL8HPkJScOSjY28oo/dcktMufK5t9b7rKxUYXhW:3O4rQtGPZwjYBPdvo53KxUYXhW

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Users\Admin\AppData\Local\Temp\606.tmp
      "C:\Users\Admin\AppData\Local\Temp\606.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-06_b8c4dec165547797b48381d1bbc1ef01_mafia.exe CAA377505B5195D9CCB27F0D8AC493E9913D17A09AAA58F489F940F31C5B02274EFEBA632775D6D7CB471BE33966B8E1A754F4F6A54844DA88C41F9F4F89F2CA
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1020
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1156

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\606.tmp

      Filesize

      486KB

      MD5

      427b74fd5cb8d37cd478f6f954ee1ba4

      SHA1

      2c2628e62dcd92c0b0ca1de6e63119285372891c

      SHA256

      1af16065d03fa2aedebd0b0b49736f46b1212fbf2b537945f1d86e7f456612c3

      SHA512

      eb8bc47f0e3a3fcf4c24370e172a335b8c41d79a0401df46e607a1c9acf7b5ecb538047ebdd030969dceaa7d210694a913e8b1f303c2bd1a70ba65f80c779be7