Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2024, 22:42

General

  • Target

    2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe

  • Size

    433KB

  • MD5

    d2d731b98dcce96aa163fd9fa38b38b6

  • SHA1

    c4e2571a0e0ddb536e4a2c0dc97c187c07034be7

  • SHA256

    a94f14d5fc9c818e7f691a5d8aa1304220716e164d4d5d05eb536f6af9d35ada

  • SHA512

    e32c7a8558614d07368a78110e5c59a169df822066ebcdafd95137915254eacb864c632e75436a8026d8189fbc104cd89daa925a04a31309f8e02b79709d31d9

  • SSDEEP

    12288:Ci4g+yU+0pAiv+cKh6qtWkWjKnX/ihFCTXqNpJGXn:Ci4gXn0pD+c06qtrWunPi3Kqq

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\3E9F.tmp
      "C:\Users\Admin\AppData\Local\Temp\3E9F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe 52CB0FDA87618159726398E2DEB91BD8586136E8D4AD61182ED32626BF2A81910B3F8FAE5FB4B4F7908B4D28830A77869217D92D5D275AC989079350348B76EB
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3E9F.tmp

    Filesize

    433KB

    MD5

    a2061ad2aaca1ef51c4ed2090247af3c

    SHA1

    efac972dc04d5c0365cb5c1bb122eccf01565dce

    SHA256

    335937207e80fa8cc1b02e52656572e0707897107eefcfc411b055e3481fd152

    SHA512

    633821233bce78d9c2677ae0f2ec47d08d694d7a7898006509a630c1355d9bb6c759a439febc3786992940c897fdc77f2cdeb980f05881d777beb93cbc5b5236