Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2024, 10:45

General

  • Target

    2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.exe

  • Size

    486KB

  • MD5

    aad61ac3e33fe531bdab4456a74630ee

  • SHA1

    6fa7355208ee3a124d8e0bc67286c6bf65fc81ac

  • SHA256

    b439954023671142b05c14567eb3c8c0d628b4973a161f3c1754fe63c6c28ec4

  • SHA512

    14a2e05bea31914fc4a8eb2ea47fffe888d07fd19f134dfd4703c0a28d12d5ca250aae989516bc3891cefc968c8ad05c7060a2274a74970d0c01387132d4fa20

  • SSDEEP

    6144:pRPu8zwNAZjCZrIik3tHHzdXOcee/leHqptIWljq2IlnCBctGrsH2fj:purIik3NdphIqXIWluXEGtLUj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\AppData\Local\Temp\3D2F.tmp
      "C:\Users\Admin\AppData\Local\Temp\3D2F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.exe 645C3486C7B3E6D83400EE1217F057C03CE745F396159EE74325D8FEB8C59D0C7553024AAF029FA162AFED0F5DAACC99CD1BA5249DE37FDBDD6DB6095214A8D3
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.docx"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2024-03-18_aad61ac3e33fe531bdab4456a74630ee_mafia.docx

    Filesize

    21KB

    MD5

    7079891932a64f097abafd233055a1e9

    SHA1

    246d95feafe67689d49a5a4cadba18d3ac1914e5

    SHA256

    c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

    SHA512

    6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

  • C:\Users\Admin\AppData\Local\Temp\3D2F.tmp

    Filesize

    486KB

    MD5

    23da92dd68689527cd211d6669164728

    SHA1

    7a2caf20304d6ecb8d17367240cd2f77de5deaee

    SHA256

    fc9741136cf8687c44f443384e1217cda727f5541b36dae75a5f141bb5bc203c

    SHA512

    c73307aa9bbaca2f6570b89aff7d3674760351f1144398ef6c1ce4bdeb5f8bbfb56b5c297f8570c4dd1c82510ddd1514a88d5d1ad0b0ad347cc61cd5a87b38b2

  • memory/1444-0-0x0000000000AD0000-0x0000000000B52000-memory.dmp

    Filesize

    520KB

  • memory/1444-7-0x0000000000AD0000-0x0000000000B52000-memory.dmp

    Filesize

    520KB

  • memory/1736-10-0x000000002F9C1000-0x000000002F9C2000-memory.dmp

    Filesize

    4KB

  • memory/1736-12-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1736-13-0x00000000713CD000-0x00000000713D8000-memory.dmp

    Filesize

    44KB

  • memory/1736-17-0x00000000713CD000-0x00000000713D8000-memory.dmp

    Filesize

    44KB

  • memory/2380-6-0x00000000012C0000-0x0000000001342000-memory.dmp

    Filesize

    520KB

  • memory/2380-11-0x00000000012C0000-0x0000000001342000-memory.dmp

    Filesize

    520KB