Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe
-
Size
486KB
-
MD5
d131b0a6b3de376671043ecc62584e9e
-
SHA1
123227dab17c964b84ca66f59d5b2b1b71e14996
-
SHA256
5402c6bb4c123398c941a2635e74a231b6f16356e4b5249270e83fa7d0755249
-
SHA512
baef4f82763bc181194ab8cfe9b74b46db4f52ac2fe3d0f93d9d64c3ec6c7fac4d9a5c72def7eaab53987e4d4358db2ac92df21dc89ae97f122ac193bb58ac88
-
SSDEEP
12288:3O4rfItL8HPBtc150kFFEcy8r1ZMep7rKxUYXhW:3O4rQtGPBtc150kf3bp3KxUYXhW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1692 362D.tmp -
Executes dropped EXE 1 IoCs
pid Process 1692 362D.tmp -
Loads dropped DLL 1 IoCs
pid Process 2236 2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1692 2236 2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe 28 PID 2236 wrote to memory of 1692 2236 2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe 28 PID 2236 wrote to memory of 1692 2236 2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe 28 PID 2236 wrote to memory of 1692 2236 2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-09_d131b0a6b3de376671043ecc62584e9e_mafia.exe 475DBB9D0C237A83D4D6809D0B29BA1A9C68A4DB9EAFAA89FC2AD4AEF97C419D65CB49A521541A69A3C365D48A4CAD0DE8B4CC7484B37E3A3761789CDB66806A2⤵
- Deletes itself
- Executes dropped EXE
PID:1692
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
486KB
MD5c2b8b5cb2ef7f689d6aa2c5ada8a4ff9
SHA1eb67d41bf936ca82600280429ad89fd6019b0df7
SHA2561f8bf84487b48871625098a3f6191e72ebe6a6f5baf87d0734ccb3c73331deef
SHA5124320ca45e72f035f6f2c0a6be28788746fec0a01705d24ea77f6de66360e84f6314c151992a1e443bc416281cf168f3da93273bbbbaa9f1e0091feb9f4d912a2