fd1153fb916f49fc3ebdab27a274306606d0ad81decf7b6d6c48e17252421832

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 13:23

Target

714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe
Size

189KB
MD5

714bb6ab1d4a5a23bdf19f0ba9555b75
SHA1

a3ff584824b127084fe8370f92711c7098141ecc
SHA256

fd1153fb916f49fc3ebdab27a274306606d0ad81decf7b6d6c48e17252421832
SHA512

93a145af526878a17aa4430026fffd91a5a35b3a160eb9b18995d812efe67effc8d5c800f11b86ec89e4a341c7aefe12553158fad24e799f92594965b2962640
SSDEEP

3072:jVkukYegjaTKChZJ2c7UTyE0HUTdlsBib/BOVLiNhx9/cySHgGtbgX:2ukqenv1ZE0Hswib5OghxehV1g

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1812	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1812	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	29
PID 1988 wrote to memory of 1812	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	29
PID 1988 wrote to memory of 1812	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	29
PID 1988 wrote to memory of 1812	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	29
PID 1988 wrote to memory of 2904	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	30
PID 1988 wrote to memory of 2904	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	30
PID 1988 wrote to memory of 2904	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	30
PID 1988 wrote to memory of 2904	1988	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2904

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\HWID.txt

Filesize
271B

MD5
e5623594988cbd134fb15198e70ea24b

SHA1
873ceb593ac86aa8eea0a030a9b53029b3182d89

SHA256
66f19ef4373cb8dd23a3d915c838d7f0231a754813a972d8d55ef5cd60f57583

SHA512
d27376db7133ad940a8116ebde6b2ada31cb05ce6b16376c7ddb3b03af4808e852cad1eca193661e2aa1ae149a108c4c7740efed76c8e1f024cdbab4430d6aac

Download Submit