Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2024, 07:27

General

  • Target

    2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe

  • Size

    428KB

  • MD5

    093bd62a074e7f17e41ac5743195f688

  • SHA1

    2753c50e4aa607495e1ba6876ec5b9ad7c846be6

  • SHA256

    8d0d34badddd9ba755a4d8d4a3ab4c76bb82a1454b792d751a3a88e90552a67d

  • SHA512

    275800892a907b3b7d5cd140fb0b45a4a7b7fa5827a3bba3d66b0b3696f13c70232560cd60a66557b68eeb86ca5958a519f434fbe47cd3a36177ab402172737a

  • SSDEEP

    12288:Z594+AcL4tBekiuKzErqsLBgbPkqm2juH2sSCk36yXaPL3ytdl:BL4tBekiuVr1qBjuHXSqyXaPzy3

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\648D.tmp
      "C:\Users\Admin\AppData\Local\Temp\648D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe 993D9515E1DBB621F559C80D7D41A0A02726E9815FEB7B7F5BA383AA4D43D5FCB1B5EFBE76A57DBDD7CAFF1A590257F81040EE184E0D8D41078CCB18E85CB7D7
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\648D.tmp

    Filesize

    428KB

    MD5

    1d4c29bd7c5f75e64ad48248af9ba05b

    SHA1

    55115db9ccbc077b76cd23b31b9f6a71571c5694

    SHA256

    65c4067e5f6ddfdc3af4f12b2d8b28b8d607c59907cc29d67b72fe722d8b9a2c

    SHA512

    a086d3b86168cf5221c21cf204c5db4dc6e7f0a4ef6e85767ca901db34ba0d10625cb07bd4f0bd9e537157329556940b7dcd515d3dbc0a1f71490b3de69d9557