Overview

overview

8

Static

static

3

6925b5f412...JC.exe

windows7-x64

8

6925b5f412...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2023, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6925b5f4124cc2579cc79485df454933_mafia_JC.exe

  • Size

    4.0MB

  • MD5

    6925b5f4124cc2579cc79485df454933

  • SHA1

    3e3f8ef44b713af8a92424abdd105962d26e3980

  • SHA256

    727c9b6456e569d5914cee5352df3dbc7cc64bddf3dd8298ed1795f181ca4fc8

  • SHA512

    7c94563440c309f6ad4ee6e1978d1a316df8d27854d21786d1583d0b6ec19edbe43b4a63fe85757296382e536a9d72ac2a621ae8df3c802318ac7a84fd61d144

  • SSDEEP

    49152:C9yiCJ5rFwnANZGEXep+9TxFegOSDAmosh3ANkTTl37olwiC55mHuynn/wbi7Xq:pJ5rFwnApezgOS9V3AMxewiCmHuyn/b6

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6925b5f4124cc2579cc79485df454933_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6925b5f4124cc2579cc79485df454933_mafia_JC.exe"
    1⤵
      PID:2552
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2816-54-0x0000000003E00000-0x0000000003E01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2816-55-0x0000000003E00000-0x0000000003E01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2816-59-0x00000000026D0000-0x00000000026E0000-memory.dmp

            Filesize

            64KB

            Download