Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe
-
Size
476KB
-
MD5
c1a5ed45841f952ad1ba06dccf712972
-
SHA1
fcde8ca060fbc394853ee9dc626faac1e87fb329
-
SHA256
672d53aac0e65a7fe5b5211ee639b658d7dec4cd0005a199acd9c1d36413a07d
-
SHA512
fb327dee1c7346a130f9ac3e780db704290311d38bb51441074b18eb22e9d2a66169edc231873c2431cf347259e32dff35c11fd9eb02e4999399652c8416db7a
-
SSDEEP
12288:aO4rfItL8HRdbm7CGAF9blmbSSOchS+W7K9wlsDpVFd:aO4rQtGRdbCCGAF9A3OcNW+9wlsDpVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2704 25C9.tmp -
Executes dropped EXE 1 IoCs
pid Process 2704 25C9.tmp -
Loads dropped DLL 1 IoCs
pid Process 3028 2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2704 3028 2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe 28 PID 3028 wrote to memory of 2704 3028 2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-08_c1a5ed45841f952ad1ba06dccf712972_mafia.exe CEFC25809E8B455C2CB0F8EF3110A827E6A90B761B41B1B8E8BF79F20A8674DF1C89F34A4440B7D8C4104D6AAE5CAA76C6AC38A6D0EBA7822DBC681580B0BF0B2⤵
- Deletes itself
- Executes dropped EXE
PID:2704
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD55704b31bd9e428f229f3faeab1c855cf
SHA1306550ef4a310ec9b4ecb34582d763a0cf3694be
SHA256716e1c538904c9cb4c519738af563638d170498b9785278d310cabbb7c4a2441
SHA51203b5f11ea76c2fa0639373308fe3bfbd07c251093123440236723d3322db1b0e332a8f7b6e253b0b92d8ec696d199042e1cbcf5a6ac86a9f46269594774d331c