1e7919852e580945155479b817d7f6ad80377f277eba328b7c90013f7cae9b3b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe
Size

1.9MB
MD5

a4c4fa2c4783193431ef23b7cf24ba87
SHA1

35970787d49a38684331889adf855b9d6c0c47dd
SHA256

1e7919852e580945155479b817d7f6ad80377f277eba328b7c90013f7cae9b3b
SHA512

6190d32ffd4f28d8361da59a18291994c9584743fb86aa483f0107e0dfca06e2af4615d37fdbaeb8ad0c9b556a9e0ca73ea2790f690459b1cf116906abf723ac
SSDEEP

49152:izX5pRDKnI8dHaPm1iiNU+rMDCgWBqzYU3ytCEzDvEMYiVYiwh+3:izU/sMY2YL

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Executes dropped EXE 1 IoCs

pid	Process
340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Loads dropped DLL 3 IoCs

pid	Process
2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe
1248	Process not Found
1248	Process not Found

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\ = "Compatibility"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runasuser	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\HasLUAShield	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-10156"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\ = "@shell32.dll,-50944"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\DropHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\EditFlags = 38070000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%1"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\ = "MS-DOS Application"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\EditFlags = "0"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runasuser\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\print\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{1531d583-8375-4d3f-b5fb-d23bbd169f22}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\HasLUAShield	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon\ = "%SystemRoot%\\System32\\shell32.dll,2"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\edit\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-68"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\DefaultIcon	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\ = "Compatibility"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\DropHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ = "Windows Batch File"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\ = "@shell32.dll,-50944"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\EditFlags = 00000000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\Extended	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shellex\DropHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\EditFlags = 00000000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Application"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\DefaultIcon	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\Extended	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6002"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-68"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%1"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.com	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-8464"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.exe\PersistentHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\DefaultIcon	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{1531d583-8375-4d3f-b5fb-d23bbd169f22}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "Application"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.bat	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\ = "@shell32.dll,-50944"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\ContextMenuHandlers	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\edit\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runas	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\ = "MS-DOS Application"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shellex\DropHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\HasLUAShield	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-10156"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runas	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\ = "Compatibility"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ = "Windows Batch File"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.com\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\DefaultIcon	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shellex\DropHandler	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\EditFlags = 00000000	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6002"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\HasLUAShield	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\ = "Compatibility"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\Extended	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\runasuser\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\Extended	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\DefaultIcon	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\runasuser\command	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2804	Notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe
Token: SeDebugPrivilege	340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 340	2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe	29
PID 2772 wrote to memory of 340	2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe	29
PID 2772 wrote to memory of 340	2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe	29
PID 2772 wrote to memory of 340	2772	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe	29
PID 340 wrote to memory of 2804	340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe	34
PID 340 wrote to memory of 2804	340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe	34
PID 340 wrote to memory of 2804	340	a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe	34

C:\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe
  C:\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\System32\Notepad.exe
    Notepad.exe C:\Users\Admin\Desktop\Rkill.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Filesize
1.1MB

MD5
8d498649c852e56285479359232d3812

SHA1
6daf9a7f9a69829c95ab4d84404b559a3254dabd

SHA256
fdeb54c00f1f9e9c0c16c2610e82616f7c99ba67555e1ddad3f6faf427bc67a3

SHA512
e19803dae3989ca0a090d4e1d09c46537696e084fed2c58e6df4b0f8c1ddf503997310b9445ab2d03c1d4dbfd573e7dbeed99a2f99ec04445b70ab87442af128

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
4KB

MD5
56799ba2929d63ab222111992360a8db

SHA1
b04406b93b3e205e4df6146753050eab71e8c884

SHA256
8db86a1f9f7316c76c6a3eedd52b01b25c53464de82c2c102042f09e3ad5756d

SHA512
f25a43b90172de4cb5c65e3e1bd8df81bed23699a636eda1cf4ce60be04676cf53c35128fa8bda333af85d2609e4b69432a30bf35d521cea574acae996797e5c

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\Rkill.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Filesize
1.1MB

MD5
8d498649c852e56285479359232d3812

SHA1
6daf9a7f9a69829c95ab4d84404b559a3254dabd

SHA256
fdeb54c00f1f9e9c0c16c2610e82616f7c99ba67555e1ddad3f6faf427bc67a3

SHA512
e19803dae3989ca0a090d4e1d09c46537696e084fed2c58e6df4b0f8c1ddf503997310b9445ab2d03c1d4dbfd573e7dbeed99a2f99ec04445b70ab87442af128

Download Submit
\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Filesize
1.1MB

MD5
8d498649c852e56285479359232d3812

SHA1
6daf9a7f9a69829c95ab4d84404b559a3254dabd

SHA256
fdeb54c00f1f9e9c0c16c2610e82616f7c99ba67555e1ddad3f6faf427bc67a3

SHA512
e19803dae3989ca0a090d4e1d09c46537696e084fed2c58e6df4b0f8c1ddf503997310b9445ab2d03c1d4dbfd573e7dbeed99a2f99ec04445b70ab87442af128

Download Submit
\Users\Admin\AppData\Local\Temp\a4c4fa2c4783193431ef23b7cf24ba87_mafia_JC64.exe

Filesize
1.1MB

MD5
8d498649c852e56285479359232d3812

SHA1
6daf9a7f9a69829c95ab4d84404b559a3254dabd

SHA256
fdeb54c00f1f9e9c0c16c2610e82616f7c99ba67555e1ddad3f6faf427bc67a3

SHA512
e19803dae3989ca0a090d4e1d09c46537696e084fed2c58e6df4b0f8c1ddf503997310b9445ab2d03c1d4dbfd573e7dbeed99a2f99ec04445b70ab87442af128

Download Submit