Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2024, 07:27

General

  • Target

    2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe

  • Size

    428KB

  • MD5

    093bd62a074e7f17e41ac5743195f688

  • SHA1

    2753c50e4aa607495e1ba6876ec5b9ad7c846be6

  • SHA256

    8d0d34badddd9ba755a4d8d4a3ab4c76bb82a1454b792d751a3a88e90552a67d

  • SHA512

    275800892a907b3b7d5cd140fb0b45a4a7b7fa5827a3bba3d66b0b3696f13c70232560cd60a66557b68eeb86ca5958a519f434fbe47cd3a36177ab402172737a

  • SSDEEP

    12288:Z594+AcL4tBekiuKzErqsLBgbPkqm2juH2sSCk36yXaPL3ytdl:BL4tBekiuVr1qBjuHXSqyXaPzy3

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\758E.tmp
      "C:\Users\Admin\AppData\Local\Temp\758E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-08-03_093bd62a074e7f17e41ac5743195f688_mafia.exe 7D47F23C49618C40D3DD9A91DC6CB562CAFCBEA7E2D48864F7C551D6591F0F5E94ECB2951DD88D4E8164FE84B4B90EAA9F0DA96FB695AFB79A0094812821A94C
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\758E.tmp

    Filesize

    428KB

    MD5

    88a7c745439300bfd440c10f28996aa7

    SHA1

    4764a8f38091cc8b2bc60800ee19b47c9c6b6d85

    SHA256

    9f232f9219aa2d67682f9b8df1d62a32150aafa2701623fa2522b1071c02d8db

    SHA512

    37997ef722370c7f3066272c2551d9c43a5366d41c13e3b6e0407a6134be028b3a81bd1045be4eb1519ff98e36535dda6f33e563c08d3e78aab6f87f35c7fc2e