Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
22/08/2023, 18:30
General
-
Target
70dec1b9bc8804cbfcfa84edc9939f22_mafia_JC.exe
-
Size
295KB
-
MD5
70dec1b9bc8804cbfcfa84edc9939f22
-
SHA1
098a5931ee9d0fe4ea8ed4e53c0997529ade77ed
-
SHA256
6bcc900513ac32847bcf28f986b44825695f760ba77f9f82bd9cbad558642b0a
-
SHA512
cbcac425787f3e944d1612ff092f2b683d28ee66f96a3f14744b13143b2658a9f6076a744ca3ef35bb6573901ce2a4e7fd809285a5085d98a1871bbdfe448caa
-
SSDEEP
6144:LDUKgm4Wiw6pbnyhJZ1uQtv3NxjMjtG6ZLlYZE:LgK7ow6pbnyzlv3NuLZLlYZE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70dec1b9bc8804cbfcfa84edc9939f22_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\70dec1b9bc8804cbfcfa84edc9939f22_mafia_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n8677\s8677.exe"C:\Users\Admin\AppData\Local\Temp\n8677\s8677.exe" ins.exe /e10391128 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 44682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3892 -ip 38921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD518332589d7068650441ab03e352a3441
SHA1df6c95c22d184cff4003e5048282eb007389b86c
SHA2564b2956d97453ae7889ba67a84c88c3e64f19786c7f871a1e79217e168cbe133f
SHA5126923bf1cbe68508ed146b26ab4ee8f74b6949d5dde2706e7a888ed334f9dde9f659daa5de48b3dbaff34ab46e6a5dbbd4be118f97d31fc25e1d1df2ef2d88f34
-
Filesize
269KB
MD518332589d7068650441ab03e352a3441
SHA1df6c95c22d184cff4003e5048282eb007389b86c
SHA2564b2956d97453ae7889ba67a84c88c3e64f19786c7f871a1e79217e168cbe133f
SHA5126923bf1cbe68508ed146b26ab4ee8f74b6949d5dde2706e7a888ed334f9dde9f659daa5de48b3dbaff34ab46e6a5dbbd4be118f97d31fc25e1d1df2ef2d88f34
-
Filesize
269KB
MD518332589d7068650441ab03e352a3441
SHA1df6c95c22d184cff4003e5048282eb007389b86c
SHA2564b2956d97453ae7889ba67a84c88c3e64f19786c7f871a1e79217e168cbe133f
SHA5126923bf1cbe68508ed146b26ab4ee8f74b6949d5dde2706e7a888ed334f9dde9f659daa5de48b3dbaff34ab46e6a5dbbd4be118f97d31fc25e1d1df2ef2d88f34
-
Filesize
296KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
5.1MB
-
Filesize
1024KB
-
Filesize
9.6MB