Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/04/2024, 08:34
General
-
Target
2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe
-
Size
384KB
-
MD5
4024d88bf72fc20f7575bf97c5c59382
-
SHA1
7eabfcdc09e75be5f5c1560f87b3f0616554c7f1
-
SHA256
12938fb34442871b60853de3afe7d034b6fa086dcfd086fd87e022ba3589bd29
-
SHA512
faf79319f3f2a02a61ba2c4de910347c8c2a9f1c1db33c545429c2f83128132cbdb308535c18d53d33afeedc40be17bef04817c10e269d08636b983292c5ebae
-
SSDEEP
6144:drxfv4co9ZL3GBGgjODxbf7hH1+Ehr7kqnaEDvP1Wv1laHqDN8SZ:Zm48gODxbzSEhvkqjP8vTVRZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-11_4024d88bf72fc20f7575bf97c5c59382_mafia.exe 5042D4BA0605F5690B4DE7E48B7676FDC8B92C2AE8A8E3305E3738A2F065A8343F42B6073B5BC5FDF83BF794FAC0A4C2ACFE9192D2848D346424D3BA48B80A542⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD55ecdcdd61abf993d02409cf03734e8c4
SHA169e45f0ec5837ffcd786df0052af21088bdff0f8
SHA256f09db6dc47685f7553aea02bf07a4c0de51f9ae482988163b5f6a3b126dcee09
SHA512d9e04dd0b97753a7607a962abbe4abf1b733d6c481b267726fd9304ae271c922203eb01cbb32cb6f1441932f0064f096f606823564c1bb65b1225e85ed904715