Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe
-
Size
476KB
-
MD5
fb4c72d982a74aa3bcb5fe47adf07395
-
SHA1
7559daf3c627d507528e49c3c2d5f3ee1694b260
-
SHA256
b27b3e2fe31fc6f7e513ac462a33ca3051422739099774b7093abc3eb3cd8c84
-
SHA512
e3fb7ac01044cb2b4a3feb19f307379bde7743049186b4f7a60b49a6b7f5d64f7d0e8689f9fc4d1739dbc144101bf7dd5eb084368bfee026f7d4817f1f21a8cf
-
SSDEEP
12288:aO4rfItL8HRyTwuygWFTgAHHf31eF7K9wlsDpVFd:aO4rQtGRyp4Hf31eF+9wlsDpVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2364 11BC.tmp -
Executes dropped EXE 1 IoCs
pid Process 2364 11BC.tmp -
Loads dropped DLL 1 IoCs
pid Process 2876 2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2364 2876 2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe 28 PID 2876 wrote to memory of 2364 2876 2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe 28 PID 2876 wrote to memory of 2364 2876 2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe 28 PID 2876 wrote to memory of 2364 2876 2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-05_fb4c72d982a74aa3bcb5fe47adf07395_mafia.exe BE36FFACCD279C164AEAC1A94DAE6B2EC643DBF70C63CA45348A41C2FBED84328BCC259A20A0D5E9B9EB4D56EA12A16A09A361898AA581645D0833A4C731F32C2⤵
- Deletes itself
- Executes dropped EXE
PID:2364
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD57bf4fe899f713e68b851faae2c3958eb
SHA1fc92a980d71421eb812b0ce97cbf5165fc7896f0
SHA25681fb3353015051b2be2028326535f608b65a8adfaf42030096badc2e14b7d874
SHA512de2dcf5d5391ac64fe4e0428d97ccbb5b8cbadc3543745dcb3e6216697604601b6ab30b0322d4d5d6a62ec6216c0742d9470afe6f67c7c42923ee4c43deb0017