Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18/03/2024, 22:42
General
-
Target
2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe
-
Size
433KB
-
MD5
d2d731b98dcce96aa163fd9fa38b38b6
-
SHA1
c4e2571a0e0ddb536e4a2c0dc97c187c07034be7
-
SHA256
a94f14d5fc9c818e7f691a5d8aa1304220716e164d4d5d05eb536f6af9d35ada
-
SHA512
e32c7a8558614d07368a78110e5c59a169df822066ebcdafd95137915254eacb864c632e75436a8026d8189fbc104cd89daa925a04a31309f8e02b79709d31d9
-
SSDEEP
12288:Ci4g+yU+0pAiv+cKh6qtWkWjKnX/ihFCTXqNpJGXn:Ci4gXn0pD+c06qtrWunPi3Kqq
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe F3077C0443F3D508B7FF55300C21A15F59874272E79D4C5C3B3C59D386E01A1B9FEB299FB5DB3A6E487401617029205D8F34D806AA66144A75046BE8550DB6CF2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD58cf4ed180c210a36269f4641db1ae74e
SHA14d9ae110542e53de9cc0e3bd07beaf3befe13ed2
SHA2568674ce899947fafbbe23c970d8dca4c7c853a57a58e21b30d24cdf8dec5aa861
SHA5129b34a878b1dbdfbd93b7acfdb54dfa783ab2ba7e8799f8ee45ac2b14d396e8ce46d08f474f96f6ff8f072015fdb11a6011090fd77d18afe89d8e62a9fd0c2ee9