Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe
-
Size
411KB
-
MD5
97e5c199cfb2455853dd7ff0a6a44d39
-
SHA1
8e9c0c810c7a1da4f7becd190c31f646defa81fb
-
SHA256
4dd17650ddd730577d425849dca84dcb230cd5767eccdaae8a3977bd84d49334
-
SHA512
53d15bf31c4170169775a9542589f5bd87fbec9d8aee32262db1d26c684c628f6998ab9ab61566081218e87d5f8d31810fe72e17a281fc6fc9be0f9ab709756b
-
SSDEEP
6144:gVdvczEb7GUOpYWhNVynE/mFNend7NPeKsUbLf836KypSLRmWGHuo5HcvqH:gZLolhNVyECend7N/scHKfLghLcvqH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2896 1249.tmp -
Executes dropped EXE 1 IoCs
pid Process 2896 1249.tmp -
Loads dropped DLL 1 IoCs
pid Process 2100 2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2896 2100 2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe 28 PID 2100 wrote to memory of 2896 2100 2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe 28 PID 2100 wrote to memory of 2896 2100 2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe 28 PID 2100 wrote to memory of 2896 2100 2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-05_97e5c199cfb2455853dd7ff0a6a44d39_mafia.exe DC50A707A1A5F050E38E80BC1825F83349F2C4F4421D4EF4FAF1607B355C2FDF0D954371093131A3D6499607DE93CC4963A3281ABF6B2665D144ACED9D9A260B2⤵
- Deletes itself
- Executes dropped EXE
PID:2896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD55b50bb6fe14ee39500fbbbe90e0b61ee
SHA1203aaf85b100d2d687fab59df58c304e7abfcc1c
SHA256dc39959a5130101107f3df251beb323342a49ca1e1f044f7baf797524c766254
SHA512a8935568fdaf36e48366f7de82cd92cab907536fc7ccab25268deca63333270b2081911cb3bc5e4eb8610c734409d67a88233afa3c3ffdc1eb52f9a0b6e34dcc