Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe
-
Size
479KB
-
MD5
e4072af64f4bf394cb3b9910fcb9af02
-
SHA1
72c9776194d6b94eb375e9b715c19c8ae1b35b0e
-
SHA256
6b4c7aed3dd0aa419d081d08d543248de5cdaafdda2e8f7c5c024356990c53d0
-
SHA512
e408a0372fd71037b2057dc4182ba4bc73e2d5c23ff5441522161e8ff6dd5f9b0b3eb96e7a202a9d2fd43e70d555ae35a25ce07b246e9392601be66dcac2112d
-
SSDEEP
12288:bO4rfItL8HA7thJ7dUDf8j+8dPV0NVqK4nT6bcD75UO:bO4rQtGAJhxsw+i90NVUiGVUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2064 954.tmp -
Executes dropped EXE 1 IoCs
pid Process 2064 954.tmp -
Loads dropped DLL 1 IoCs
pid Process 1756 2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2064 1756 2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-18_e4072af64f4bf394cb3b9910fcb9af02_mafia.exe 8C6B38B2A98B66913278D969EF69D039901B01E1C551691A898A28E4B0B87F7FAF40752F7B6035D4D64D6E8E1BF75848E91AD2555A108E731AAE18ECC69562472⤵
- Deletes itself
- Executes dropped EXE
PID:2064
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
479KB
MD5725a84a8ccf74269cdad7db7db78d2d5
SHA1aa6fb15ff6c58574f524c36622a674cd3fe78f83
SHA25663f2bb2648585adc70ec94f381888542b0c558cef34e3e7ce668e30345b4a4c6
SHA5129a6dd10046290002ddcac5c89c3ba748037c93ae5b4dd92754f4fd95cc936e95a65ce5299b17818ca2bee8092b86441dcef963cd79cd5570b4468cc77dd3f288