Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/04/2024, 16:27 UTC

General

  • Target

    2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.exe

  • Size

    465KB

  • MD5

    28f3b2b1d0bf2746d2d9e747547d32b3

  • SHA1

    aaa7c59532c450b2095452c5c03590a594180561

  • SHA256

    2cc7f9f4c45bf0677ff07c444e64cb334341b55fba561160f09829abcfdaa0b3

  • SHA512

    a66e50bf6fec7c211fc51fa5455d30338a802753cfbcf9870ada907d534603f84e16d66694c4a0213c3c914fed441feb03d1c1490c44fa218bd12183bbd96f50

  • SSDEEP

    12288:Bb4bZudi79Lt094CSmNC77NdAUyS+dNyMCCdvqA:Bb4bcdkLth5X7nGldv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\5966.tmp
      "C:\Users\Admin\AppData\Local\Temp\5966.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.exe 6610B3B6FAD05CF93C748F46AF3B3369E43AF91B589279570A3D99CE90FF3DA81E9C1AFAB391A01B165645ACC7BB864DD1D13E58FE3CF3F12F106C06CEBF601A
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.doc"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:2344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2024-04-05_28f3b2b1d0bf2746d2d9e747547d32b3_mafia.doc

      Filesize

      35KB

      MD5

      a6b03fc9e5439b7504ba08010a960962

      SHA1

      e93a74f35ac1ed020158642eb1f2087fd31fc7c6

      SHA256

      b3b306a9618a08a003443e00e8ce2fcb14040775c3aeadc11cf120668e98dff1

      SHA512

      decbe4fa7eec0833a27acbde8b4de099124aa42e551f710fb615e6fc5aa0056ce9e44fc282e4930b1a669a1e012700b2c79cebc8a7b8ee4c66cfc29c800cddd0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      7c8491b238414d54bed62e5279a322c6

      SHA1

      d56a4686d71a33c21fb171e66b3655e06bc1d29b

      SHA256

      413c7b925a3a7ea05e644d6043827500b7230cb75832bc70c6a101230153f327

      SHA512

      c5e20bfb18e0b7e936c943701203ecfc2bed41c308b1b785367e9bf822ca95a30a9fbed4e0dd93cf534aca0f52bf07c5b7959bf9a4de13f7249168ec4f618aae

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • \Users\Admin\AppData\Local\Temp\5966.tmp

      Filesize

      465KB

      MD5

      bd4e49cc1ad72525d60896cdcf761c33

      SHA1

      62da8db1eb923f4366461cd9742bcee0cb3c7e86

      SHA256

      bea1ebb34f11a38bdc11dae51f800226c68b152aac6cfb8f52a104b6012db764

      SHA512

      1eb5f6b00a6684662a3dc1e0eb101753ecc47bab2b0e68e4278b825a15cd75e53379e338c2f3246fd36d47fcba0f5bde944ded972addfca0553f042811d9d246

    • memory/2672-7-0x000000002F951000-0x000000002F952000-memory.dmp

      Filesize

      4KB

    • memory/2672-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2672-9-0x0000000070D5D000-0x0000000070D68000-memory.dmp

      Filesize

      44KB

    • memory/2672-28-0x0000000070D5D000-0x0000000070D68000-memory.dmp

      Filesize

      44KB

    • memory/2672-43-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.