Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe
-
Size
476KB
-
MD5
67084a7559fa7e0a9e0edce2455e6a9f
-
SHA1
72238d993d9b40f398cd7f1f8b6e9b86e6674445
-
SHA256
abe7eec07bdaaef2e36f404d9f12821d8bf5cdb69db9e833c64d7fd2ca5dab1a
-
SHA512
99f742f0bc25e26673b9e05b51f7ed93e224bcb46a4eececd3f0e04f3334291d01c3b41c8ad6b45aad1f103059b8c0f48334a5ee7fc537dd2f2d0a95335d035d
-
SSDEEP
12288:aO4rfItL8HR9dKUvkPDtZxn49ARKFDszVVQ2em7K9wlsDpVFd:aO4rQtGRfMPDXeepg2x+9wlsDpVFd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 804 DE6.tmp -
Executes dropped EXE 1 IoCs
pid Process 804 DE6.tmp -
Loads dropped DLL 1 IoCs
pid Process 2372 2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 804 2372 2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe 28 PID 2372 wrote to memory of 804 2372 2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe 28 PID 2372 wrote to memory of 804 2372 2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe 28 PID 2372 wrote to memory of 804 2372 2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-10_67084a7559fa7e0a9e0edce2455e6a9f_mafia.exe 60483B6673ADDCEA6148FCF728FC7A8D74856935AE918F2CD65B4E021F0312C3F22F98B82E352A19031068D450A647707342783364B634BB7B71F522A737EA2D2⤵
- Deletes itself
- Executes dropped EXE
PID:804
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD5137219dabc1e66bceae64553531e52db
SHA13b941872dda9f0888775bb0c4a186bf45ff73d63
SHA25674cfba614772f775f06084d3bc0376de75a9d739495ad72071dd91a1a2938f01
SHA5121df877a2a2bb0e9732afe7e6cf6f7aa7fec3c187406c63ce61ec78b9a67d11a01d3df4ee070858aef58018d5d9cc8992fecdd85a64ffb1d5cd745e797e7aae33