Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe
-
Size
435KB
-
MD5
e26f65a024896f3bbc6a4be2bbb5d66c
-
SHA1
1e9f59afdd4d3ee1c11dbbd385af0873bc9e1382
-
SHA256
375dea4e4eb06b6eaad75490e52927fab2ab8f7009184196ea3d92859f113f16
-
SHA512
98e97c7a622586ceb4f6b9fa4f4c3048db0579662b17f3099feabd9eca68c8aaec5b573c43b298bece9131b9538b9dcbbc981b0e5da5c475c260452a1a30fc85
-
SSDEEP
12288:9W4ufepiqKQ1mVOW2k1Ei8neghcYqicxZoVJ:9W4ufepiqhmp1EDQ1u
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2168 7169.tmp -
Executes dropped EXE 1 IoCs
pid Process 2168 7169.tmp -
Loads dropped DLL 1 IoCs
pid Process 2180 2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2168 2180 2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe 28 PID 2180 wrote to memory of 2168 2180 2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe 28 PID 2180 wrote to memory of 2168 2180 2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe 28 PID 2180 wrote to memory of 2168 2180 2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-27_e26f65a024896f3bbc6a4be2bbb5d66c_mafia.exe 943463F4B70C15E062A36CCE67CBF5156D73FD79453AA4EC8165CB71F08E4BBED0329162F3EE8428CAFA7FEA5FA0E40CBCDA05B9E8E0CD30C9023FEF88332E342⤵
- Deletes itself
- Executes dropped EXE
PID:2168
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
435KB
MD56b89b2c7a171d2cb52fe6361be617f8d
SHA15c5c5a0d7348d7704c731db40498a78abc4c74db
SHA256b8c1e5fe34c263afcf724d6b192b4742a3a57994938e50e8af086fe89775f29d
SHA512433586256eb6a80d7c31e57b638988faec531494295221f87b6bda3c752f2634cf39cd9fc0508e894c822bf85b1ddd96f32df4d8c604db2d33c4ab52fa38cc70