Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
-
Size
255KB
-
MD5
5f88e9dea36c0a29fcee359567ca68a3
-
SHA1
68f8fd802e635799166f1098ba17bd54235a7b0c
-
SHA256
06a1095054a1ab69bc13662b60f21a725d50286fabecd045f6df744b213a4c4e
-
SHA512
938b78aa7e453cd2c9352a45bf757825d00797589a568af2b415dbe9899d45cf4ab8ba535783a3d9398868fc6cbedbe11196da5d7d81c883e28bd221d181f452
-
SSDEEP
6144:o64tXafE0Mqpm+SKAqpByuqPoEbLvRdvf1:o68r0Mqpm+SCB3KbLzN
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Loads dropped DLL 3 IoCs
pid Process 2976 regsvr32.exe 3020 regsvr32.exe 2760 explorer.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32 regsvr32.exe -
resource yara_rule behavioral1/files/0x001b00000001561d-3.dat upx behavioral1/files/0x001b00000001561d-4.dat upx behavioral1/memory/3020-7-0x000007FEF71F0000-0x000007FEF725D000-memory.dmp upx behavioral1/files/0x001b00000001561d-6.dat upx behavioral1/files/0x001b00000001561d-8.dat upx behavioral1/memory/2760-10-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-12-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-14-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-15-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-19-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-25-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-26-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx behavioral1/memory/2760-31-0x000007FEFC2E0000-0x000007FEFC34D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\ = "MediaViewerPluginLib" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ = "IMediaViewerIdentifier" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\ = "MediaViewer6172 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\MediaViewer\\plugin.dat" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ = "IMediaViewerIdentifier" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\TypeLib\ = "{3692066A-7A10-4CB5-AFF3-9DDE336E97AA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1234066A-7A10-4CB5-ACCC-6172630174DE}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45615F2E-872A-4F2D-9A08-475EC8605622}\ProxyStubClsid32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 2760 explorer.exe 2760 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2760 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe Token: SeShutdownPrivilege 2760 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe 2760 explorer.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2436 wrote to memory of 2976 2436 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe 28 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 PID 2976 wrote to memory of 3020 2976 regsvr32.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\MediaViewer\plugin.dat"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3020
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5bf52cd701b14f23225a64bd76dcf8cdf
SHA10fe0076f87777d7752f60e8a6f76e9ec5e1aa82a
SHA256eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d
SHA5126b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2
-
Filesize
77B
MD5fcc21d925935117d130df4d9a26a5f56
SHA154541069b09a46091885de0259034d05ac978417
SHA256ebfead48ce9da04104743c987943d6fc31703ea6917dbec7dfc3b3856950b119
SHA512b817d976696898ef45d5fa70feeec69cd18cbac5db05bc380bdfcb5812862a0887cd52dcb5740db61482d68adb47899f40a1d4bd7006e293e29d545ff14ed78f
-
Filesize
95KB
MD5bf52cd701b14f23225a64bd76dcf8cdf
SHA10fe0076f87777d7752f60e8a6f76e9ec5e1aa82a
SHA256eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d
SHA5126b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2
-
Filesize
95KB
MD5bf52cd701b14f23225a64bd76dcf8cdf
SHA10fe0076f87777d7752f60e8a6f76e9ec5e1aa82a
SHA256eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d
SHA5126b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2
-
Filesize
95KB
MD5bf52cd701b14f23225a64bd76dcf8cdf
SHA10fe0076f87777d7752f60e8a6f76e9ec5e1aa82a
SHA256eeb1c2ed27eecd4b717dc484a1c292ce7e74dc5510983964573a509a28613a2d
SHA5126b4987625e29671bd4e0d4ab37b47dadd05c983e8c02fd8b2bb02e0d689bce0d0cfd0d128b84a9d15d76151f1b48ebb1052ddddba6366b6f5ccdc1dab06935e2