f4b98fe769a867c6ab7d358008c7b89f599fcfb1d289710a4e7a606d3fdb4338

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe
Size

460KB
MD5

992ec60e28edde8f1ba9d64cfb4f76a8
SHA1

7d72ddcc599d801da00e49bc03b7f8db46593539
SHA256

f4b98fe769a867c6ab7d358008c7b89f599fcfb1d289710a4e7a606d3fdb4338
SHA512

873ae53fed5f1d426666e3a3a8d15b78100dfbf23b0da1c37f9d532adafa14502fb6d0b1801622fc776bcc90bdbf58e761e0cdc247160b0c5d412d74b47366c5
SSDEEP

6144:2qYNNo+Jg1sNtkv+5rdMJ2A9jdz5EDG3ncBRIMoBmdz7Fz8sqLDPr6UnvFYvTYNr:2qmOElNtkG5FvBSMoyysqLvkTYNr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4832	s9238.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1764	4832	WerFault.exe	83
4312	4064	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe
4064	992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	4604	dw20.exe
Token: SeBackupPrivilege	4604	dw20.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4832	s9238.exe
4832	s9238.exe
4604	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4832	4064	992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe	83
PID 4064 wrote to memory of 4832	4064	992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe	83
PID 4832 wrote to memory of 4604	4832	s9238.exe	85
PID 4832 wrote to memory of 4604	4832	s9238.exe	85

C:\Users\Admin\AppData\Local\Temp\992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\n9238\s9238.exe
  "C:\Users\Admin\AppData\Local\Temp\n9238\s9238.exe" 90cb16979a46181ce83ace1a7dstwF7Kyixy9KGTkF1DaHQSd4HYDOa7Ujjocw0QqFHxGE0H502Fg0xfYgjezrTymsAz4x+s7nyzEj07kGA6Hcxx9+5nPe7IkfsSdG2zTB0+eLneb2NONjqyd3h0uw== /v "C:\Users\Admin\AppData\Local\Temp\992ec60e28edde8f1ba9d64cfb4f76a8_mafia_JC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 1216
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4604
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4832 -s 1224
    3⤵
    - Program crash
    PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 4464
  2⤵
  - Program crash
  PID:4312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 4832 -ip 4832
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4064 -ip 4064
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n9238\s9238.exe

Filesize
160KB

MD5
9c12e804c38cba812da4c33f5712812a

SHA1
2b87227c320d96b39a15a3495db7ced809a602da

SHA256
aad1bcdd48e97408dfb03eefd7b64e397dc5083c4fee9ffca1d241eaeb307040

SHA512
9a1c4ee314cb64be9765d04ed1c2eadd0ddeebf75c8c24ec352c9f1a2a8d0c159cea84fcaf36def36aeaaf934dc0b07abc57d76628572ab7fd6bdb9531729c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\n9238\s9238.exe

Filesize
160KB

MD5
9c12e804c38cba812da4c33f5712812a

SHA1
2b87227c320d96b39a15a3495db7ced809a602da

SHA256
aad1bcdd48e97408dfb03eefd7b64e397dc5083c4fee9ffca1d241eaeb307040

SHA512
9a1c4ee314cb64be9765d04ed1c2eadd0ddeebf75c8c24ec352c9f1a2a8d0c159cea84fcaf36def36aeaaf934dc0b07abc57d76628572ab7fd6bdb9531729c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\n9238\s9238.exe

Filesize
160KB

MD5
9c12e804c38cba812da4c33f5712812a

SHA1
2b87227c320d96b39a15a3495db7ced809a602da

SHA256
aad1bcdd48e97408dfb03eefd7b64e397dc5083c4fee9ffca1d241eaeb307040

SHA512
9a1c4ee314cb64be9765d04ed1c2eadd0ddeebf75c8c24ec352c9f1a2a8d0c159cea84fcaf36def36aeaaf934dc0b07abc57d76628572ab7fd6bdb9531729c0e

Download Submit
memory/4832-14-0x0000000000650000-0x000000000067E000-memory.dmp

Filesize
184KB

Download
memory/4832-12-0x00007FFA30FE0000-0x00007FFA31981000-memory.dmp

Filesize
9.6MB

Download
memory/4832-13-0x0000000001130000-0x0000000001140000-memory.dmp

Filesize
64KB

Download
memory/4832-11-0x00007FFA30FE0000-0x00007FFA31981000-memory.dmp

Filesize
9.6MB

Download
memory/4832-15-0x000000001BB10000-0x000000001BFDE000-memory.dmp

Filesize
4.8MB

Download
memory/4832-16-0x000000001C080000-0x000000001C11C000-memory.dmp

Filesize
624KB

Download
memory/4832-17-0x0000000000F80000-0x0000000000F88000-memory.dmp

Filesize
32KB

Download
memory/4832-18-0x0000000001130000-0x0000000001140000-memory.dmp

Filesize
64KB

Download
memory/4832-25-0x00007FFA30FE0000-0x00007FFA31981000-memory.dmp

Filesize
9.6MB

Download
memory/4832-26-0x00007FFA30FE0000-0x00007FFA31981000-memory.dmp

Filesize
9.6MB

Download