Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 03:46
General
-
Target
2024-02-14_3d170915468ad2a3e7534020113add97_mafia.exe
-
Size
462KB
-
MD5
3d170915468ad2a3e7534020113add97
-
SHA1
66d5c92335b5a20a2682f81e2b510ae728de6178
-
SHA256
be9a2db2aaf8e46f48287b44eb333570c2f8be52d157083c2eeba9cf83786198
-
SHA512
b41471f382735d3fec4e20b4706dc9e247f330dd4cc30c23c977fa4cb6dd80a2cccc48d78131c8b57ba5c98ef294485d26139a46b85b497e5b4e0edfd63833a6
-
SSDEEP
6144:zRPu8zwNAZYCZrIik3tHsqQuz6DWs4Ks2+RkD+ztLqc5H6++1RHZ8NR+AjrsH5f:zJrIik3+o1KT+7ztmMa++19N9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_3d170915468ad2a3e7534020113add97_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_3d170915468ad2a3e7534020113add97_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-02-14_3d170915468ad2a3e7534020113add97_mafia.exe E7B9264D2C791076CB3FA3245B2BF1606502FBCC1B4845903ADF07A85462D170A6609E9689693C5F8C17744FBD7777C92676851AB81EC9EE4ECA30F7347F94742⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-02-14_3d170915468ad2a3e7534020113add97_mafia.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD57079891932a64f097abafd233055a1e9
SHA1246d95feafe67689d49a5a4cadba18d3ac1914e5
SHA256c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1
SHA5126e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a
-
Filesize
462KB
MD525ed9de51956bf396102de21ea03b51a
SHA1bdd781cd24c8673c899d2a5cdb98348ad832990b
SHA256d7ae270c432dfe146beda6b617ce7fb38d12a6f2a7d625f4a550df71d79703b2
SHA512625945d0157d4c3fda8e425fe436faee556701a145c5a6bdea06736dd03f0240c36c3673823f70a3b37497e0cbab9d2e973f6bc3174593d5f4ac9166b69cd35e
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB