Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
16/04/2024, 15:38
General
-
Target
2024-04-16_d62395f62c59740f16de2c60d4d53be3_mafia.exe
-
Size
448KB
-
MD5
d62395f62c59740f16de2c60d4d53be3
-
SHA1
faf420707eb8580ddc4e6a6bf4622fe1125f198d
-
SHA256
75d9a2ff8999a542d182dc31ce7d74b9f45739e47acb7ee6b27ef5ea8634c748
-
SHA512
243c12b75b39b47153b7fc078cac34d7ef3acc2897d70e2b0f1615b4982e95b6336ebf333a688fdd64b85a2227bac45eff784a7e5ce1d0d6ab612ff78082a35c
-
SSDEEP
6144:3FrJxvldL4c5ONK1tgRbd1s79+i5+Ls4uzLN0EZqtEiK2diPLhV8/FaSNADmX0q:lb4bBxdi79L4s4umEZXiKjsyDmXJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_d62395f62c59740f16de2c60d4d53be3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_d62395f62c59740f16de2c60d4d53be3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-16_d62395f62c59740f16de2c60d4d53be3_mafia.exe 46C5B783DAFBEBCCE9B74AC3AFF167F2D89B73F25FBC0E6AFC2927C978BCF31795151761FD376CB89D3A313ACF441FD83D4612431220B17A35A9221D2E837CFA2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD53e226b966832fcfdaacda0a3ddae3f0b
SHA13c914b95cd2ba0325cefa229f311e7061ef9478e
SHA256c6becfa04442cb244d6a77c55dc4f28f3b334b502bda891c792205b5627aa7ab
SHA51279057e1700af142120cc1e270e14322f327209ba8a5d5c613b4cb4cb80a5e81ea28360c646ea92541a591f83d2a0ab7b7a8c469d889158de590d6ada155032cb
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB