Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe
-
Size
476KB
-
MD5
f30bf47900eb562aa4c8c9cbeab7b650
-
SHA1
dd8de92639f655f5bc2a3da3f7ef0a9c8da1c10a
-
SHA256
552667404bc2b49578951c3ae8499f5ae13ede3f53392483ac0fcb4e7aab0d54
-
SHA512
c5540d4da4bf33c6459f33c2bda2cb1333404a310220b7f9050a119ee35e2244d1ba5491d340e7a968df340c01687e8c52ae1617c028c09542ff648bbd2b932f
-
SSDEEP
12288:aO4rfItL8HRkwChaSbNdBpAx1LYaSBfHTn7K9wlsDpVFd:aO4rQtGRkXhFbNOLka0+9wlsDpVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2308 1046.tmp -
Executes dropped EXE 1 IoCs
pid Process 2308 1046.tmp -
Loads dropped DLL 1 IoCs
pid Process 2320 2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2308 2320 2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe 28 PID 2320 wrote to memory of 2308 2320 2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe 28 PID 2320 wrote to memory of 2308 2320 2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe 28 PID 2320 wrote to memory of 2308 2320 2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-06_f30bf47900eb562aa4c8c9cbeab7b650_mafia.exe 08635BF45745B80C044F218C35FC8CEAF1656092708EBBFC5E4A7D3F8D5C7773AAF18EAC64DC3EE6F9333F2BD1FCE141926187E39137831221B7E6F11D59130E2⤵
- Deletes itself
- Executes dropped EXE
PID:2308
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD5a1b68789a326ba39b219e21c0ea8debf
SHA1656244a85c9cd0407dcc3a5bf6070f3e461e3cd3
SHA256bc69c0d32a08738c7ae9036521b2145562f37f4b536e0a84f65665f8f395dc69
SHA512f196ab5adcc6cf4383958ad5473d3e39d419db619d4d2459a6187ed436be111252eb684c4a66e23397f37ced9ea8d42cb1618a739c5584089d992cad19e4b4aa