68976719d61dd27f784412c63e475062de9efcb8affcd6c7d1c639c56821e848

Analysis

max time kernel
0s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe
Size

187KB
MD5

29d7452ae3b8cf36b2f66455500bfa5b
SHA1

c35e3ce358925bea168a5eff96db519ba3dc7702
SHA256

68976719d61dd27f784412c63e475062de9efcb8affcd6c7d1c639c56821e848
SHA512

bacaf05f688d94af505aae7a3ba5b1447427bfae3bf922f5a097da66f2ee04fbf40f22d975e7353425ac733cea5998997c91fad70bdd8b80f50111e7ddfbbf70
SSDEEP

3072:uLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6dvn3mxIOdGCH:e83YLmUOFXEEZnRCI3AXny/Hj8LG4ujV

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000014826-11.dat	aspack_v212_v242
behavioral1/files/0x0009000000014826-10.dat	aspack_v212_v242
behavioral1/files/0x0009000000014826-7.dat	aspack_v212_v242
behavioral1/files/0x0009000000014826-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1652	zvBbeC.exe

Loads dropped DLL 2 IoCs

pid	Process
2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe
2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	zvBbeC.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	zvBbeC.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	zvBbeC.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	zvBbeC.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	zvBbeC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1652	2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe	16
PID 2348 wrote to memory of 1652	2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe	16
PID 2348 wrote to memory of 1652	2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe	16
PID 2348 wrote to memory of 1652	2348	2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_29d7452ae3b8cf36b2f66455500bfa5b_mafia_wapomi.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\zvBbeC.exe
  C:\Users\Admin\AppData\Local\Temp\zvBbeC.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\3dba7463.bat" "
    3⤵
    PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QRPB7FNX\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3dba7463.bat

Filesize
187B

MD5
32bd19e067b86106e9f0f4694bff3ccf

SHA1
1ee5180497c0ea3a2af51515a5d899b19642f0ee

SHA256
a83f5d176e6092c24afbdcbfc39a49637f67b19c644947e977d0e1e616c82980

SHA512
cc6095d00ff321713cd2bc67158a2bf01b536e9b85639d565647532136deefdbfc8b1cf82e1bcfdf9afb66dc39425285e350283a4af18ba5c36e3b923381f937

Download Submit
C:\Users\Admin\AppData\Local\Temp\707535EC.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvBbeC.exe

Filesize
11KB

MD5
358e0f1d8a57fd754bcea073e0a30641

SHA1
e6de7493b8b2e4deafdaa4117eb1b988bf4295ef

SHA256
52b540a14266d3f353c4d3e6496bdd0b5ff339954923bbf7d5e729e27be4cdc7

SHA512
0e2ecb4787289f39d3570dfe584c8790e352954667b93f1291c99c384b01d3223a775ad932268c9550b83dff850dfa230449f1796c8a8fc27734e5b6ba2c506f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvBbeC.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvBbeC.exe

Filesize
5KB

MD5
aed4edaabfd170581ee6a8ed64b8cdd2

SHA1
3c98c0aba4af55ffab0c4b57588b62a68dfbcbc5

SHA256
d4e7156f14fbd16ca40276d47416edea9632ff57a47c1f4fda72ac49c1732f11

SHA512
d86dbe9ec35b915e60cd24d13fd8f067bf986812fdb88dc772ebb00111dbf218af501e45908a798872112e2143467731f824686daae34fcddf3cd2bd1ac93708

Download Submit
\Users\Admin\AppData\Local\Temp\zvBbeC.exe

Filesize
1KB

MD5
76ddf58a01fc1cb51e6feb217187e2ea

SHA1
0df8103b757663557599e242387a03a1a38f689c

SHA256
8e944264e2e1be5143bbeb754c45d956f8988e8893efff3186f50ed80a27d693

SHA512
fdff3d971e5cb53c867f3529d87e25d87f90a3e724d643a2b46eed1c382007df9a86baa0b5cfa4e9e1a70c1e3df2dc23d7ad6518b846991da39365bee4f93843

Download Submit
memory/1652-34-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download
memory/1652-13-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download
memory/2348-9-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download
memory/2348-8-0x0000000000240000-0x0000000000275000-memory.dmp

Filesize
212KB

Download
memory/2348-0-0x0000000000240000-0x0000000000275000-memory.dmp

Filesize
212KB

Download
memory/2348-12-0x0000000001260000-0x0000000001269000-memory.dmp

Filesize
36KB

Download