Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17-02-2024 10:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
-
Size
1.9MB
-
MD5
d5cdd366da8ff7b7dcda895273f7aad4
-
SHA1
24607364390995311078195f3c294c5eb849d650
-
SHA256
4864b090370fa294424ee677b31d5f938de11e28601159967b905d447b480cfd
-
SHA512
390a2749a7f9c2f9d252718619aaaccede5b0d06f7b3d792427a8abdd5b7303a43ef73af9bf3883f867d1403c1ec1801859c9ca9eccfd6403f640f3b78b04e5c
-
SSDEEP
49152:TOBaLa0w/ZMlSbB9K/TTfZAKRiWsMw0eoaR3joQBTy:TOBaLa0wRQSbgiK0udaRDBTy
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe -
Modifies registry class 5 IoCs
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F44EFD-3F20-2CCD-9F0A-B8B79813C5DD}\InProcServer32\ThreadingModel = "Apartment" 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F44EFD-3F20-2CCD-9F0A-B8B79813C5DD} 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F44EFD-3F20-2CCD-9F0A-B8B79813C5DD}\ = "Search Protocol URL Generator" 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F44EFD-3F20-2CCD-9F0A-B8B79813C5DD}\InProcServer32 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35F44EFD-3F20-2CCD-9F0A-B8B79813C5DD}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SearchFolder.dll" 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exedescription pid process Token: 33 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Token: SeIncBasePriorityPrivilege 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Token: 33 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe Token: SeIncBasePriorityPrivilege 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exepid process 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 3044 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exedescription pid process target process PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe PID 2352 wrote to memory of 3044 2352 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe 2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5cdd366da8ff7b7dcda895273f7aad4_mafia.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3044