Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe
-
Size
433KB
-
MD5
d2d731b98dcce96aa163fd9fa38b38b6
-
SHA1
c4e2571a0e0ddb536e4a2c0dc97c187c07034be7
-
SHA256
a94f14d5fc9c818e7f691a5d8aa1304220716e164d4d5d05eb536f6af9d35ada
-
SHA512
e32c7a8558614d07368a78110e5c59a169df822066ebcdafd95137915254eacb864c632e75436a8026d8189fbc104cd89daa925a04a31309f8e02b79709d31d9
-
SSDEEP
12288:Ci4g+yU+0pAiv+cKh6qtWkWjKnX/ihFCTXqNpJGXn:Ci4gXn0pD+c06qtrWunPi3Kqq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 228 3E9F.tmp -
Executes dropped EXE 1 IoCs
pid Process 228 3E9F.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4352 wrote to memory of 228 4352 2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe 88 PID 4352 wrote to memory of 228 4352 2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe 88 PID 4352 wrote to memory of 228 4352 2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-18_d2d731b98dcce96aa163fd9fa38b38b6_mafia.exe 52CB0FDA87618159726398E2DEB91BD8586136E8D4AD61182ED32626BF2A81910B3F8FAE5FB4B4F7908B4D28830A77869217D92D5D275AC989079350348B76EB2⤵
- Deletes itself
- Executes dropped EXE
PID:228
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD5a2061ad2aaca1ef51c4ed2090247af3c
SHA1efac972dc04d5c0365cb5c1bb122eccf01565dce
SHA256335937207e80fa8cc1b02e52656572e0707897107eefcfc411b055e3481fd152
SHA512633821233bce78d9c2677ae0f2ec47d08d694d7a7898006509a630c1355d9bb6c759a439febc3786992940c897fdc77f2cdeb980f05881d777beb93cbc5b5236