Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28/03/2024, 14:56
General
-
Target
2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe
-
Size
441KB
-
MD5
fd7572aec057817259e8ad18629d5ded
-
SHA1
dbc7db8ae68bef04596a732227b9a1e1f6417ff9
-
SHA256
f650e588098741d7c5d5f116d9abe28d44c6305a21441a3118e9b7366560d92f
-
SHA512
2a3201df2c650c5c65328214bd1e11406e4b546f00f1d82a1deda7644ca4f1098f51affdd27f8184e15e4a81d9c6ef79beacd4c19eb360b83b989385cdbd818e
-
SSDEEP
12288:6i4ET7+0pAiv+jF19zhGiGrPmfk/Cyo9hb:6i4ETK0pD+99SJQD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-28_fd7572aec057817259e8ad18629d5ded_mafia.exe A22FE116D4B98307D4225827AA0F92CB8060D1368FBC861CFCD88EAE2E43AE36E0066AE523C5AA4D67E53F38AD92B2EBCD89480A3D80AA6E193612ABFCCBE5882⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
441KB
MD5f459bbd83b54c7be02d2b49871b5d911
SHA141c3476d232d03fce29c5595217f5f9fc2102d3c
SHA256ce002d6cecdc2054e515c45f238e7975ecde8532df6acad514a9d81ea0d1b6e2
SHA5120069e3807189cb226cf17a9513edec210a8c6d1ec75f4087d18f499005fb23a39c95186af9df2fd808884808bd634a20c77bd5dea9620457bcecd1172fdb70ec
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB