fd1153fb916f49fc3ebdab27a274306606d0ad81decf7b6d6c48e17252421832

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2023, 13:23

Target

714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe
Size

189KB
MD5

714bb6ab1d4a5a23bdf19f0ba9555b75
SHA1

a3ff584824b127084fe8370f92711c7098141ecc
SHA256

fd1153fb916f49fc3ebdab27a274306606d0ad81decf7b6d6c48e17252421832
SHA512

93a145af526878a17aa4430026fffd91a5a35b3a160eb9b18995d812efe67effc8d5c800f11b86ec89e4a341c7aefe12553158fad24e799f92594965b2962640
SSDEEP

3072:jVkukYegjaTKChZJ2c7UTyE0HUTdlsBib/BOVLiNhx9/cySHgGtbgX:2ukqenv1ZE0Hswib5OghxehV1g

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
368	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe
1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 368	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	83
PID 1584 wrote to memory of 368	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	83
PID 1584 wrote to memory of 368	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	83
PID 1584 wrote to memory of 3800	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	84
PID 1584 wrote to memory of 3800	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	84
PID 1584 wrote to memory of 3800	1584	714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\714bb6ab1d4a5a23bdf19f0ba9555b75_mafia_JC.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3800

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\HWID.txt

Filesize
271B

MD5
c92b2186872cc04bdb1d5705ad431012

SHA1
57d015f09e2c163b29615f1946861f26a62fa84e

SHA256
4ca9ac669cdd3ab94b93ea1ec148aff9aa132c89a6e2ac6ecaea6d6fa649ffab

SHA512
e72c8cf0fba58fe07903c4f0c48e9f285b7f866b72b20cc083a5a0c7e6fbd496a22cf3c97a573735b6b563d7ae1a2090bb3bd947e816afcc4bd7825c38498044

Download Submit