Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 13:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe
-
Size
226KB
-
MD5
a59db8705df134d2e45baad764eafacd
-
SHA1
b2fdb441774ca67e6d54b0552314f711d3a6499e
-
SHA256
c56e1debdbe76c464560803f2828652e28df343439f5812391d165dc2f61798a
-
SHA512
a1c712e12fda7e10d213f55ed26319ddd2b5e43e883eb079453f77bae6a0eafdcacba5c053aae944ff703f81e18f6198c5aeeca8d814b6a6bba1c6ac4056cbc6
-
SSDEEP
3072:a3xlAEfqNeouWd1+TS+AijVw4fV/vnUo+/Sts:a3xltj5M1cS45j5co+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1432 winsvc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\T-5060548008706965508605070\\winsvc.exe" 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\T-5060548008706965508605070\winsvc.exe 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe File opened for modification C:\Windows\T-5060548008706965508605070\winsvc.exe 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe File opened for modification C:\Windows\T-5060548008706965508605070 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2828 2412 WerFault.exe 83 1328 1432 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe 1432 winsvc.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1432 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 87 PID 2412 wrote to memory of 1432 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 87 PID 2412 wrote to memory of 1432 2412 2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_a59db8705df134d2e45baad764eafacd_mafia.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\T-5060548008706965508605070\winsvc.exeC:\Windows\T-5060548008706965508605070\winsvc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 5163⤵
- Program crash
PID:1328
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 5482⤵
- Program crash
PID:2828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2412 -ip 24121⤵PID:4064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1432 -ip 14321⤵PID:512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD5a59db8705df134d2e45baad764eafacd
SHA1b2fdb441774ca67e6d54b0552314f711d3a6499e
SHA256c56e1debdbe76c464560803f2828652e28df343439f5812391d165dc2f61798a
SHA512a1c712e12fda7e10d213f55ed26319ddd2b5e43e883eb079453f77bae6a0eafdcacba5c053aae944ff703f81e18f6198c5aeeca8d814b6a6bba1c6ac4056cbc6