Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10/04/2024, 21:45
General
-
Target
2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe
-
Size
448KB
-
MD5
ce9812687db2250fafad3ad30ba2ae4b
-
SHA1
1151e8e2e5b9a7eefe3f73d53a557cd526c2739a
-
SHA256
faca6e88208fa73daf98687795281cb437cd15c4f8100a494cf78e8ec3a09b5d
-
SHA512
ce84fb584c62453f5f307ea56b281637704c69f8ba6e22e943343835949224b0175822b10ccbcb672596409394e537a3d2492ab45e32d39f91e52086e64b214d
-
SSDEEP
12288:lb4bBxdi79Lh25a95jmQmhwdux+z+K8hTklRA4:lb4b7dkLoUS9hgucMTol
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_ce9812687db2250fafad3ad30ba2ae4b_mafia.exe E24F3BCC4C90065C36A04818A30670C2C8FE455A0DF83C186DCE910712846F69B7196263A8FE72A1908E5582E7B5FA3583D68902C0DF801E5990583DE4C74CDC2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5b4d299af5f97458bbaa3597a9f45e298
SHA12ffba8a0ca3b53ce8d9cce32b4027b8a637a2e9b
SHA25664a854f0d363867d103c71edfc1ee808cad50102eebaa819bf32b2efbcfb7e8f
SHA512a0ae24e55a6c25d8c8cf74015dbe731a6c21ca04e3277194cd0a480cd5fdc6dfe86743a3b1d3b1bd706654043fb9f43bd32252d4f03d9a87af6c863e0a514030
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB