Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
28/04/2024, 00:36
General
-
Target
2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe
-
Size
468KB
-
MD5
b565cf3e49551f8d25b9a3553956034b
-
SHA1
1b732e3f3684fa822bf1d1a77781e4adb539b4c8
-
SHA256
0e193621d01a55a6f23d3c89174b3ef1c40618906183abab0a32718f7635f28c
-
SHA512
ce4e5f54a7279e35f1aa1cebd6c6e677d3193c9f6ed2070383e457c87016164e6ad4bb6127d6b709dc025315156def95df7c9178610598c7d2ac3ec07929f803
-
SSDEEP
12288:qO4rfItL8HGs4a6qe44ms8+ixKBY8i7bWmeEVGL:qO4rQtGGs6qe44mspiYW/umeEVGL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-28_b565cf3e49551f8d25b9a3553956034b_mafia.exe 02249040237DF7DB065C9CA8F0391141F8A680633888884B401D6B977ECEF1ABD8BF9C90EA67E7531499C8D48A4BCD77C1B82901D550B840963702A0405D3BD82⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD52440abc1a608b8e89abbc29310b093da
SHA169a31791910d8045ca2aaeadb47366bd2bf91d71
SHA256b62e685015f163f1240452049b6f71337aa6afae11cad3baa2192d6548a23b20
SHA51232f8fd883ede40519a6c741cb23d0d62c4d964b3286059c456465ff1a37c491440b697dab494c9361b2f1676f2c41c0f9e6b7354ab4e79aea6de3e32865a86cb