Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
-
Size
834KB
-
MD5
58f5a13b4aa5c8f842f3251a5e38dd17
-
SHA1
b32df71c9ea192b0b01746006d19c4fff978d898
-
SHA256
0405c1498334674079e48358702da47bd387f9a8ea29a04ef4d91fd6cd36f85d
-
SHA512
0519ea8887bbaa97d5dbcd9c05bdcc006459b3b757c98053ec1e102e41e75b87bfe24f9f9b2e0a186dee417812a838cea3373b7ed40862b672cd808c9305eb93
-
SSDEEP
24576:wmWZuw4sX2LM2y1yxXlmf7ICkBUKd47iJ:wm2wPLYWXAjIxd47
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\"" 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\" self-delete" 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3316 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2268 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3884 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe 3884 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3316 taskkill.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3884 wrote to memory of 3204 3884 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe 100 PID 3884 wrote to memory of 3204 3884 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe 100 PID 3884 wrote to memory of 3204 3884 2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe 100 PID 3204 wrote to memory of 3316 3204 cmd.exe 102 PID 3204 wrote to memory of 3316 3204 cmd.exe 102 PID 3204 wrote to memory of 3316 3204 cmd.exe 102 PID 3204 wrote to memory of 2268 3204 cmd.exe 104 PID 3204 wrote to memory of 2268 3204 cmd.exe 104 PID 3204 wrote to memory of 2268 3204 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /pid 3884 & for /l %x in (1,1,60) do ping 127.0.0.1 -n 2 -w 500 & del /q "C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe" exit2⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 38843⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 2 -w 5003⤵
- Runs ping.exe
PID:2268
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:2032