02b83bc46711bba6047adf5e7e26faacd70c81faa4b3cdc0229a99c670375d64

General

Target

942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe
Size

462KB
MD5

942e97b814c17fb29428e22fb4f788c1
SHA1

65896b5725371ae91f8e1e384c61c6ae12958717
SHA256

02b83bc46711bba6047adf5e7e26faacd70c81faa4b3cdc0229a99c670375d64
SHA512

3c368c5b399b0abb27110b5b9fa509d8a1ede3f406a7057b7eff3d3a75e50a73f63261eaab0fd42cd04d1e9e3163ccbf3c1821080ecd0ee69a02a800ffe37257
SSDEEP

6144:zRPu8zwNAZYCZrIik3tHR5iFUZnKy1i8GU+8cnz4t+RcD4ZkBF2KXcaZnE8arq+S:zJrIik3sq28GU+Hct+2s2BFZcuQfu9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4524	7ABE.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	7ABE.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4364	WINWORD.EXE
4364	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4524	7ABE.tmp

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE
4364	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4524	4808	942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe	83
PID 4808 wrote to memory of 4524	4808	942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe	83
PID 4808 wrote to memory of 4524	4808	942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe	83
PID 4524 wrote to memory of 4364	4524	7ABE.tmp	85
PID 4524 wrote to memory of 4364	4524	7ABE.tmp	85

C:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\7ABE.tmp
  "C:\Users\Admin\AppData\Local\Temp\7ABE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.exe 0B6813AB58F442AF16554A569BBDC455C4822520E015D1F2895FCF37BA217DE9D96092911A6E63B808DEB39CAEA7F3423ED7A9D1DCE34D32FE8449EEFE8A9F06
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.docx" /o ""
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ABE.tmp

Filesize
462KB

MD5
afd332dbd2f10c235e565c5099d5d7a7

SHA1
2651dbc7ee5c289e1daa1ddaaf2e627e0d506c19

SHA256
f0b33fcef9d173124da44acf2b3a778f84182fce45780c5d6762a24b8948ddbe

SHA512
53ee460b5b7f2c72d7dc0513216f5206522c4aa515d03d85ac794c84ada91e667859edec5eeb42f8de11ec69eda60585c6b21e7b7677d0efa9d341010179bc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp

Filesize
462KB

MD5
afd332dbd2f10c235e565c5099d5d7a7

SHA1
2651dbc7ee5c289e1daa1ddaaf2e627e0d506c19

SHA256
f0b33fcef9d173124da44acf2b3a778f84182fce45780c5d6762a24b8948ddbe

SHA512
53ee460b5b7f2c72d7dc0513216f5206522c4aa515d03d85ac794c84ada91e667859edec5eeb42f8de11ec69eda60585c6b21e7b7677d0efa9d341010179bc45

Download Submit
C:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.docx

Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
C:\Users\Admin\AppData\Local\Temp\942e97b814c17fb29428e22fb4f788c1_mafia_JC.docx

Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
memory/4364-152-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4364-151-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-146-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-145-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4364-147-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4364-148-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-149-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4364-150-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-142-0x00007FF91D2B0000-0x00007FF91D2C0000-memory.dmp

Filesize
64KB

Download
memory/4364-153-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-154-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-144-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-155-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-156-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-157-0x00007FF91AB60000-0x00007FF91AB70000-memory.dmp

Filesize
64KB

Download
memory/4364-158-0x00007FF91AB60000-0x00007FF91AB70000-memory.dmp

Filesize
64KB

Download
memory/4364-143-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-163-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-164-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-165-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-166-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-167-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download
memory/4364-168-0x00007FF95D230000-0x00007FF95D425000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing