6266c5f61ecc740719be98714c4085c46c84790aacf4e8fbfe09491be749bae8

General

Target

2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe
Size

190KB
MD5

5cc4ed37ec099787bdaeb5aac9d85e62
SHA1

d3407422a45f46e3ed83f954f223b1988d322cec
SHA256

6266c5f61ecc740719be98714c4085c46c84790aacf4e8fbfe09491be749bae8
SHA512

2a3e4c3c340a0aa98e406c56b84c51adbbf9b5b10f04c7c9a0ad1299d90bd8a8f96aa6374103bb8eb487c1adde036c40ceae20cc638393184ed6d9d82722e221
SSDEEP

3072:cD/LRRwelzjlJlBbZpz9lZoVCVBxuH1KKMuoZvVTDz4CxcUTnEv55bAe8:i/Lgep51PzCAuLyvJDMCNnA55A

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\Local Settings	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1152	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1096	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe
1096	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3676	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1152	1096	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe	84
PID 1096 wrote to memory of 1152	1096	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe	84
PID 1096 wrote to memory of 1152	1096	2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe	84

C:\Users\Admin\AppData\Local\Temp\2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-27_5cc4ed37ec099787bdaeb5aac9d85e62_mafia_JC.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1152

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HWID.txt

Filesize
271B

MD5
1bef11116d2ddde4abb6f36573a4dfef

SHA1
b8841c617eae8fb1e33f6ad3ec2f54090c5b7717

SHA256
62f7a570b60bf74538d703eab9105f622152700dc76793d3cd59eff2a8a11182

SHA512
bf2fcd3d1337091e3f5a5b1b01094dc95cec372ef233818493296a9a16f0a9426d4a5477e1a1278eb8f71e54b6481f5b5eae97816c4532c001e1def83444c029

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
b8ce7dafa76e2e7074a0a535b0407085

SHA1
746c0fa78cb9ad0ef4152467343b71bd7d4c61d8

SHA256
4cb0158e3571583b3bf416ecb31b3e3f1791e862f073414baf7def35efb9c05b

SHA512
e4ffc04c31270227143f48704389dd0cac3a36b8244d05fbb50ad348d06223a75f07d2d92e19171a9e00265aac87e6b14a3f624f7ae1b7a2a62a6e12d4809dff

Download Submit
memory/3676-51-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-52-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-43-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-44-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-45-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-46-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-47-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-48-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-49-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-53-0x00000271444E0000-0x00000271444E1000-memory.dmp

Filesize
4KB

Download
memory/3676-42-0x0000027144890000-0x0000027144891000-memory.dmp

Filesize
4KB

Download
memory/3676-26-0x000002713C2A0000-0x000002713C2B0000-memory.dmp

Filesize
64KB

Download
memory/3676-50-0x00000271448C0000-0x00000271448C1000-memory.dmp

Filesize
4KB

Download
memory/3676-54-0x00000271444D0000-0x00000271444D1000-memory.dmp

Filesize
4KB

Download
memory/3676-56-0x00000271444E0000-0x00000271444E1000-memory.dmp

Filesize
4KB

Download
memory/3676-59-0x00000271444D0000-0x00000271444D1000-memory.dmp

Filesize
4KB

Download
memory/3676-62-0x0000027144410000-0x0000027144411000-memory.dmp

Filesize
4KB

Download
memory/3676-10-0x000002713C1A0000-0x000002713C1B0000-memory.dmp

Filesize
64KB

Download
memory/3676-74-0x0000027144610000-0x0000027144611000-memory.dmp

Filesize
4KB

Download
memory/3676-76-0x0000027144620000-0x0000027144621000-memory.dmp

Filesize
4KB

Download
memory/3676-77-0x0000027144620000-0x0000027144621000-memory.dmp

Filesize
4KB

Download
memory/3676-78-0x0000027144730000-0x0000027144731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing