Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    31/08/2023, 15:06

General

  • Target

    f0311735013d71ee66679e1d12b69059_mafia_JC.exe

  • Size

    462KB

  • MD5

    f0311735013d71ee66679e1d12b69059

  • SHA1

    29b2da0f5c25c96110106468fd40a22c7f09ab38

  • SHA256

    f76e683691b7f2bf7912290ac97419752034a9c76cb1c9d5c9ca658677874684

  • SHA512

    bac393ede69db5cb5f5453fb026592e94483c1a50abe40faf30c4ffce73a9684ac762a23a134c7f56ea48ee24b2979220c94c30c41568716915d80f901b06d1d

  • SSDEEP

    6144:zRPu8zwNAZYCZrIik3tHLPcTEuiOxlUEx4MB3VIvJLd2WnpSCXkxXpZLsH5f:zJrIik3CIKlUg4S3VIhL8WpSCXca9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\A045.tmp
      "C:\Users\Admin\AppData\Local\Temp\A045.tmp" --helpC:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.exe 2074E65E0A6EF4F13E76DBD8F40D51C4C85FA6E57BFFFE237149DCF09B7577BA23786C323F86DA2587FB64CB455BA0840D9FDF3DC6588FC3C1D5407554B0701B
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.docx"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\A045.tmp

    Filesize

    462KB

    MD5

    adc20e97deadcb33e30a242f479168b5

    SHA1

    e59b424f6c49eda8e88ceb649ddee576c82cad4a

    SHA256

    787fc4a890926539fb1433261a9394c8741d426c9dd9827ba406eba53f9f33bd

    SHA512

    524bcefd1a871f0290d5b71a02020cb83d3ba6bcafc64ec01ba60d41f9ec28a34a8201db301f086c5f0ca401dcc3973e920b9ea548f466c2fabdfb010a2bad97

  • C:\Users\Admin\AppData\Local\Temp\f0311735013d71ee66679e1d12b69059_mafia_JC.docx

    Filesize

    21KB

    MD5

    7079891932a64f097abafd233055a1e9

    SHA1

    246d95feafe67689d49a5a4cadba18d3ac1914e5

    SHA256

    c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

    SHA512

    6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

  • \Users\Admin\AppData\Local\Temp\A045.tmp

    Filesize

    462KB

    MD5

    adc20e97deadcb33e30a242f479168b5

    SHA1

    e59b424f6c49eda8e88ceb649ddee576c82cad4a

    SHA256

    787fc4a890926539fb1433261a9394c8741d426c9dd9827ba406eba53f9f33bd

    SHA512

    524bcefd1a871f0290d5b71a02020cb83d3ba6bcafc64ec01ba60d41f9ec28a34a8201db301f086c5f0ca401dcc3973e920b9ea548f466c2fabdfb010a2bad97

  • memory/2040-7-0x000000002FB60000-0x000000002FCBD000-memory.dmp

    Filesize

    1.4MB

  • memory/2040-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2040-9-0x000000007170D000-0x0000000071718000-memory.dmp

    Filesize

    44KB

  • memory/2040-13-0x000000002FB60000-0x000000002FCBD000-memory.dmp

    Filesize

    1.4MB

  • memory/2040-14-0x000000007170D000-0x0000000071718000-memory.dmp

    Filesize

    44KB