Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31/08/2023, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
f0311735013d71ee66679e1d12b69059_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f0311735013d71ee66679e1d12b69059_mafia_JC.exe
Resource
win10v2004-20230824-en
General
-
Target
f0311735013d71ee66679e1d12b69059_mafia_JC.exe
-
Size
462KB
-
MD5
f0311735013d71ee66679e1d12b69059
-
SHA1
29b2da0f5c25c96110106468fd40a22c7f09ab38
-
SHA256
f76e683691b7f2bf7912290ac97419752034a9c76cb1c9d5c9ca658677874684
-
SHA512
bac393ede69db5cb5f5453fb026592e94483c1a50abe40faf30c4ffce73a9684ac762a23a134c7f56ea48ee24b2979220c94c30c41568716915d80f901b06d1d
-
SSDEEP
6144:zRPu8zwNAZYCZrIik3tHLPcTEuiOxlUEx4MB3VIvJLd2WnpSCXkxXpZLsH5f:zJrIik3CIKlUg4S3VIhL8WpSCXca9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1160 A045.tmp -
Loads dropped DLL 1 IoCs
pid Process 1960 f0311735013d71ee66679e1d12b69059_mafia_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2040 WINWORD.EXE -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1160 A045.tmp -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 WINWORD.EXE 2040 WINWORD.EXE 2040 WINWORD.EXE 2040 WINWORD.EXE 2040 WINWORD.EXE 2040 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1160 1960 f0311735013d71ee66679e1d12b69059_mafia_JC.exe 28 PID 1960 wrote to memory of 1160 1960 f0311735013d71ee66679e1d12b69059_mafia_JC.exe 28 PID 1960 wrote to memory of 1160 1960 f0311735013d71ee66679e1d12b69059_mafia_JC.exe 28 PID 1960 wrote to memory of 1160 1960 f0311735013d71ee66679e1d12b69059_mafia_JC.exe 28 PID 1160 wrote to memory of 2040 1160 A045.tmp 29 PID 1160 wrote to memory of 2040 1160 A045.tmp 29 PID 1160 wrote to memory of 2040 1160 A045.tmp 29 PID 1160 wrote to memory of 2040 1160 A045.tmp 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\A045.tmp"C:\Users\Admin\AppData\Local\Temp\A045.tmp" --helpC:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe 2074E65E0A6EF4F13E76DBD8F40D51C4C85FA6E57BFFFE237149DCF09B7577BA23786C323F86DA2587FB64CB455BA0840D9FDF3DC6588FC3C1D5407554B0701B2⤵
- Executes dropped EXE
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.docx"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
462KB
MD5adc20e97deadcb33e30a242f479168b5
SHA1e59b424f6c49eda8e88ceb649ddee576c82cad4a
SHA256787fc4a890926539fb1433261a9394c8741d426c9dd9827ba406eba53f9f33bd
SHA512524bcefd1a871f0290d5b71a02020cb83d3ba6bcafc64ec01ba60d41f9ec28a34a8201db301f086c5f0ca401dcc3973e920b9ea548f466c2fabdfb010a2bad97
-
Filesize
21KB
MD57079891932a64f097abafd233055a1e9
SHA1246d95feafe67689d49a5a4cadba18d3ac1914e5
SHA256c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1
SHA5126e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a
-
Filesize
462KB
MD5adc20e97deadcb33e30a242f479168b5
SHA1e59b424f6c49eda8e88ceb649ddee576c82cad4a
SHA256787fc4a890926539fb1433261a9394c8741d426c9dd9827ba406eba53f9f33bd
SHA512524bcefd1a871f0290d5b71a02020cb83d3ba6bcafc64ec01ba60d41f9ec28a34a8201db301f086c5f0ca401dcc3973e920b9ea548f466c2fabdfb010a2bad97