Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/04/2024, 16:28
General
-
Target
2024-04-05_341f7a50b2460e939af91ac9f7a3aa20_mafia.exe
-
Size
436KB
-
MD5
341f7a50b2460e939af91ac9f7a3aa20
-
SHA1
0a3368cd3dcbeb357f9242b463330bad30744179
-
SHA256
3add790fe34e14ded4618a38ca9827adadac6cb0b6d158acd702a7d05094b359
-
SHA512
9951759e1f53be54a0a814ef7fe4494c6640c70495a7b06ed68e26fd576749eb285d605480ab3f584fc0ebe5f83dd73203b139bcdb777cb28d7171c6cb2b6aec
-
SSDEEP
6144:a9EyS4oaxTkjxcW1Htg88HP7IIGy3eoOCO2UftNie/cb1S23vecynUhFhLhE7:aO4GfBtL8HPjPnRePiScN7ynUH7E7
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_341f7a50b2460e939af91ac9f7a3aa20_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_341f7a50b2460e939af91ac9f7a3aa20_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-05_341f7a50b2460e939af91ac9f7a3aa20_mafia.exe F6A5F660A4BCEFEAEBC98D2A10AA0723DDCE1E183ACDF23C5DE63F84CD3EC9FFC547C02F9982336E0CD5122D81F063A7F24C2FBC88F1CCEA410F9BC05164DEE42⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD527e40741725870b28f1151ce7d165b7c
SHA1d7d1207b67fae62cac696ee2b702de6974bcb5e8
SHA25682af7bd7e531b4566350eb524219a291d776171fd8082da20366d3018f380a8b
SHA5129f7e2e23665b68ec2978adb662f285cf3aaf81bbd433c91fd7815cd1b191c2dd09f959c9aeaef8a290151baf0c35d7ea3a30205f4b02aa4c40948bedf6285f78
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB