Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe
-
Size
12.8MB
-
MD5
18f9339a95fac76942d8999f633c3aa3
-
SHA1
0a791317aeba1090788020b6a0977a9936cdac24
-
SHA256
8c93a1ad3becf7fd178c2526ef33212acb7a6b1fb7dd4bc717e13934fdd8f127
-
SHA512
df367f27bb475073eff4060bed9a6053437bd0c3e5926a48798cb4ab1d45c63c9676252e782b8557e406895504e3ea7658d7dfaa01eccc9da9341265b0660634
-
SSDEEP
24576:PEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZk:MfotG
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Tofsee family
-
Windows security bypass 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\eefezaw = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2592 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eefezaw\ImagePath = "C:\\Windows\\SysWOW64\\eefezaw\\gidjcpz.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 3016 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1224 gidjcpz.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1224 set thread context of 3016 1224 gidjcpz.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2712 sc.exe 2548 sc.exe 2576 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gidjcpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2936 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 30 PID 2704 wrote to memory of 2936 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 30 PID 2704 wrote to memory of 2936 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 30 PID 2704 wrote to memory of 2936 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 30 PID 2704 wrote to memory of 2408 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 32 PID 2704 wrote to memory of 2408 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 32 PID 2704 wrote to memory of 2408 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 32 PID 2704 wrote to memory of 2408 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 32 PID 2704 wrote to memory of 2576 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 34 PID 2704 wrote to memory of 2576 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 34 PID 2704 wrote to memory of 2576 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 34 PID 2704 wrote to memory of 2576 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 34 PID 2704 wrote to memory of 2712 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 36 PID 2704 wrote to memory of 2712 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 36 PID 2704 wrote to memory of 2712 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 36 PID 2704 wrote to memory of 2712 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 36 PID 2704 wrote to memory of 2548 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 38 PID 2704 wrote to memory of 2548 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 38 PID 2704 wrote to memory of 2548 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 38 PID 2704 wrote to memory of 2548 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 38 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 1224 wrote to memory of 3016 1224 gidjcpz.exe 41 PID 2704 wrote to memory of 2592 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 42 PID 2704 wrote to memory of 2592 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 42 PID 2704 wrote to memory of 2592 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 42 PID 2704 wrote to memory of 2592 2704 2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eefezaw\2⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gidjcpz.exe" C:\Windows\SysWOW64\eefezaw\2⤵
- System Location Discovery: System Language Discovery
PID:2408
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create eefezaw binPath= "C:\Windows\SysWOW64\eefezaw\gidjcpz.exe /d\"C:\Users\Admin\AppData\Local\Temp\2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description eefezaw "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2712
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eefezaw2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2548
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Windows\SysWOW64\eefezaw\gidjcpz.exeC:\Windows\SysWOW64\eefezaw\gidjcpz.exe /d"C:\Users\Admin\AppData\Local\Temp\2025-01-27_18f9339a95fac76942d8999f633c3aa3_mafia.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.6MB
MD55cc38bd732910c23ecf0e6300c0d9868
SHA1569ca40bd216e51f63e25f7d4cee7ad1b1b20d33
SHA25641cfe52d4aa4a5b97f7295230afd9be31e6d84af5a9aa8f710c9e7c6218ec3ee
SHA512aa12866d6eb39ee7c91446aafe89f06f34a6802a6f8ed311baa83492d72cf996eefa0e282963ad215ba161b59b9868b872e6fb928536ea10011ca52283d59127