Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe
-
Size
428KB
-
MD5
9308ed6fa4f6b25ece1144c0446ee23c
-
SHA1
9200a26d2f121a5052ef3e751b85e8b54583e487
-
SHA256
e1ef3329ec622d8c11b48e3959895bceeab19d7b3db556af1880d88b8ad7afdf
-
SHA512
3152bf32b1e0bfb63bf6a5f7e86ec5dee8d1cb14dab8a8eb33624610cead31f22ceac7d93c28904ccb35e77a7a848686a1c75fd791697644c740c43b0f9621ac
-
SSDEEP
12288:Z594+AcL4tBekiuKzErE+sqdBDa6z1mb8KyWiV+mIx8l:BL4tBekiuVrDsqdQSnKyFVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2772 51E7.tmp -
Executes dropped EXE 1 IoCs
pid Process 2772 51E7.tmp -
Loads dropped DLL 1 IoCs
pid Process 2204 2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2772 2204 2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe 28 PID 2204 wrote to memory of 2772 2204 2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe 28 PID 2204 wrote to memory of 2772 2204 2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe 28 PID 2204 wrote to memory of 2772 2204 2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-08_9308ed6fa4f6b25ece1144c0446ee23c_mafia.exe C8B3C6294D395D3C1073D1876C551B75740A5FB6F36CF9F3B2F7E0E71CC41A81C857DE7733C20F3FDF4F6372E70F4154C01230CC0E0B62BBC20D582686E9B2B52⤵
- Deletes itself
- Executes dropped EXE
PID:2772
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD524030a80dbe5c5e26b66b233ed564fff
SHA1ff26d386be4194b1c04572d0277ae6251f1f52f2
SHA2569d02de48a8d967d903951e31cf133e16b9f5297cfeb73fc7e4ab65befece3b7d
SHA5122bc8c91a6e0571d0b991530a6f88aef9003688bcc88e175fb08994eca1da71a970d706beb339ab7a89c2c0266b597c063bca5ae1544f4d59df8cb784aaabf83b