Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 23:32

General

  • Target

    2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe

  • Size

    187KB

  • MD5

    396023ae937d9cd7eea28c981d595c98

  • SHA1

    955f83d2ac25ef84fc38259bcb8349746693009c

  • SHA256

    eaa0ba0b04296242c84fc293b1e875489516109a414088b897bfa33559084331

  • SHA512

    b9c3b82b8e64062d64e32752904afbfb24f0698babeb0035eaa761111285b948aeccbfb42b8ca95094de6349c5a99eda4309a15e3c728fffd3e2b30256cbc3dc

  • SSDEEP

    3072:uLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6dvn3mxIOUGCH:e83YLmUOFXEEZnRCI3AXny/Hj8LG4ujI

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 3 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:328
    • C:\Users\Admin\AppData\Local\Temp\zJoKwe.exe
      C:\Users\Admin\AppData\Local\Temp\zJoKwe.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\085e41c5.bat" "
        3⤵
          PID:2652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\085e41c5.bat

      Filesize

      187B

      MD5

      f6a292f5d2500de41d66a7e4b8cd9b42

      SHA1

      9faf22c9c50cb35816a4a602ffc979c15c55bec7

      SHA256

      765070d1e3acfeca830a95f56bc05b82e622ba4bf77222f9edf8d2580d3d37b4

      SHA512

      d1f179c1ec80095a481a28be89183d8076056818a3903a3324d7e726bdb7e35778fb50899eedd94cdecd6af55d5227fcbceac24abdeae192dc7e48389228189a

    • C:\Users\Admin\AppData\Local\Temp\20FB377E.exe

      Filesize

      4B

      MD5

      20879c987e2f9a916e578386d499f629

      SHA1

      c7b33ddcc42361fdb847036fc07e880b81935d5d

      SHA256

      9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

      SHA512

      bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

    • \Users\Admin\AppData\Local\Temp\zJoKwe.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • memory/328-0-0x00000000002F0000-0x0000000000325000-memory.dmp

      Filesize

      212KB

    • memory/328-3-0x0000000000CD0000-0x0000000000CD9000-memory.dmp

      Filesize

      36KB

    • memory/328-9-0x00000000002F0000-0x0000000000325000-memory.dmp

      Filesize

      212KB

    • memory/2208-52-0x0000000000CD0000-0x0000000000CD9000-memory.dmp

      Filesize

      36KB