Overview

overview

8

Static

static

3

2023-08-25...JC.exe

windows7-x64

8

2023-08-25...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 20:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-25_d3e46767c36889fbefe4aad594b6ac3d_mafia_JC.exe

  • Size

    3.1MB

  • MD5

    d3e46767c36889fbefe4aad594b6ac3d

  • SHA1

    851b1d932d55e89ae70bd7620bf0cee1be30178f

  • SHA256

    8adb40dfa9a3ca2efe9b4a851aca94ce8d3616ef40a8cb63394e87ec07c3c195

  • SHA512

    dc69c49bd92dd536fd7651483b2304171be4f7ca3bbaa66e5aa262fcb47e599c3759cda1f00b494e4d4bdb6738094af64286e758a6eacb6901ef40562c0d2e48

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlUFnHXtWWeRsZFaeKCIM7O9:c+8X9G3vP3AMiFnHXPRs9

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-25_d3e46767c36889fbefe4aad594b6ac3d_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-25_d3e46767c36889fbefe4aad594b6ac3d_mafia_JC.exe"
    1⤵
      PID:3396
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3120
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1720
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1788
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2180
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2976
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2044
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4472
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3380
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      PID:340
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3084
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:2360
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3748
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3840
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2744
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4036
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4920
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4148
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4732
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:628
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2264
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:5076
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3448
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3940
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4228
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4772
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2792

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                        Filesize

                                        471B

                                        MD5

                                        bd07e0cc05950fb02dcd07f542243450

                                        SHA1

                                        1b84aafd88e6b924df9508d550c006f2864010ac

                                        SHA256

                                        45d649104dc4c2f04d22fce98d3a2b303c32abbda6b6c1a82b5481220c7d3be0

                                        SHA512

                                        6bdfe849c4b293b861b8b8afd35a428afbb778e8d142ace5f07032d11b435a10f4ae537a8ed253a8c1b21ea00726192f94f4897e6632a9e5d21e3ce97fca4263

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                        Filesize

                                        412B

                                        MD5

                                        62b5a7eb6fb786a09960343ee47b61c0

                                        SHA1

                                        098bfeff4de60b394a16b2bd08c176ed290824b6

                                        SHA256

                                        ddfb0822a0c6bfff7a4d91a71ff07638c30af1bda2ae96a8267ff03f19ec9bde

                                        SHA512

                                        90dec364b66871425904953b27fac9d5397ddeb37b03438ff0f7501d76667fd6af2120a800b5f8f58cb85852239003192102bbcf1948c3b1bf8f147e7b114326

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        c31f790cfd02ef244af845fc39b43ad4

                                        SHA1

                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                        SHA256

                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                        SHA512

                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133417397647012467.txt
                                        Filesize

                                        75KB

                                        MD5

                                        62d81c2e1e8b21733f95af2a596e4b18

                                        SHA1

                                        91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                        SHA256

                                        a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                        SHA512

                                        c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        c31f790cfd02ef244af845fc39b43ad4

                                        SHA1

                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                        SHA256

                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                        SHA512

                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        c31f790cfd02ef244af845fc39b43ad4

                                        SHA1

                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                        SHA256

                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                        SHA512

                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        c31f790cfd02ef244af845fc39b43ad4

                                        SHA1

                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                        SHA256

                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                        SHA512

                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        c31f790cfd02ef244af845fc39b43ad4

                                        SHA1

                                        947a1baf207f5bc852b97ed0eca9a029c58b5126

                                        SHA256

                                        5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                        SHA512

                                        135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                        Download Submit

                                      • memory/628-83-0x0000000003720000-0x0000000003721000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1788-11-0x000002CB0DDC0000-0x000002CB0DDE0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/1788-15-0x000002CB0E190000-0x000002CB0E1B0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/1788-13-0x000002CB0DD80000-0x000002CB0DDA0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2044-36-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3120-5-0x00000000041D0000-0x00000000041D1000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3380-44-0x0000022CA18A0000-0x0000022CA18C0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3380-49-0x0000022CA1F00000-0x0000022CA1F20000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3380-47-0x0000022CA1860000-0x0000022CA1880000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3840-58-0x0000000004960000-0x0000000004961000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3940-106-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/4036-68-0x0000026CC59B0000-0x0000026CC59D0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4036-70-0x0000026CC5E50000-0x0000026CC5E70000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4036-66-0x0000026CC59F0000-0x0000026CC5A10000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4732-90-0x000001D475730000-0x000001D475750000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4732-92-0x000001D4756F0000-0x000001D475710000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4732-95-0x000001D475B00000-0x000001D475B20000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4772-114-0x00000248DC880000-0x00000248DC8A0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4772-116-0x00000248DC840000-0x00000248DC860000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4772-119-0x00000248DCCB0000-0x00000248DCCD0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download