Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 18:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe
-
Size
6.3MB
-
MD5
6c850ead2c8948bb6cf6bcfad01749a0
-
SHA1
448ad5835946e3e223e2aaf4ecdcc6fabd129ebb
-
SHA256
7277aff9923bc160fc591dfb30ea8b3a8ef51c322cd9182c00713bd932753526
-
SHA512
51376cf612ed38be4f3a3069bd46c7c0025139f808f77ae9c57c93fa8a415588126f6494cd44681647c60085e145d2a5e6b2a699fe931007e60fa66f0b6812b2
-
SSDEEP
98304:9uoMZZfZg0uiLsfD+gFd8J/NfLSkTIoW5FPEpBR2QiQgtmT6J5DxltVfWQQpoQx/:9uoMHBue0dWVukTu5ntFtmTqZOQQUA
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe -
Modifies registry class 64 IoCs
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{5F5AFF4A-2F7F-4279-88C2-CD88EB39D144} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000007669647300001000800000aa00389b7100000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}\FriendlyName = "MPEG-2 Video Stream Analyzer" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{ACD453BC-C58A-44D1-BBF5-BFB325BE2D78}\FriendlyName = "Microsoft MPEG-2 Audio Encoder" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{48025243-2D39-11CE-875D-00608CB78066}\FilterData = 020000000100800001000000000000003070693302000000000000000200000000000000000000003074793300000000480000005800000031747933000000006800000058000000646d637300001000800000aa00389b71000000000000000000000000000000007478747300001000800000aa00389b71 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}\CLSID = "{51B4ABF3-748F-4E3B-A276-C828330E926A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{212690FB-83E5-4526-8FD7-74478B7939CD}\CLSID = "{212690FB-83E5-4526-8FD7-74478B7939CD}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FC772AB0-0C7F-11D3-8FF2-00A0C9224CF4} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}\CLSID = "{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}\FriendlyName = "AVI/WAV File Source" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\CLSID = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}\CLSID = "{9B8C4620-2C1A-11D0-8493-00A02438AD48}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E2510970-F137-11CE-8B67-00AA00A3F1A6} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\CLSID = "{33FACFE0-A9BE-11D0-A520-00A0D10129C0}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5}\CLSID = "{CC58E280-8AA1-11D1-B3F1-00AA003761C5}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{CC58E280-8AA1-11D1-B3F1-00AA003761C5}\FriendlyName = "Smart Tee" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}\FriendlyName = "StreamBufferSink" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{ACD453BC-C58A-44D1-BBF5-BFB325BE2D78}\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000090000000a00000003170693308000000000000000400000000000000000000003074793300000000b0000000c00000003174793300000000b0000000d00000003274793300000000b0000000e0000000337479330000000090000000c00000006175647300001000800000aa00389b710100000000001000800000aa00389b7183eb36e44f52ce119f530020af0ba7702b806de046dbcf11b4d100805f6cbbea22806de046dbcf11b4d100805f6cbbea23806de046dbcf11b4d100805f6cbbea 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}\FilterData = 020000000000200001000000000000003070693302000000000000000100000000000000000000003074793300000000380000003800000000000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}\FilterData = 02000000000020000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\CLSID = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\FriendlyName = "Line 21 Decoder 2" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{370A1D5D-DDEB-418C-81CD-189E0D4FA443}\FriendlyName = "VBI Codec" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\FriendlyName = "Video Port Manager" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\FilterData = 0200000000006000030000000000000030706933000000000000000001000000000000000000000030747933000000008800000098000000317069330000000000000000010000000000000000000000307479330000000088000000a8000000327069330800000000000000010000000000000000000000307479330000000088000000b80000007669647300001000800000aa00389b71406a9b5a221ad111bad900609744111a416a9b5a221ad111bad900609744111a00000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000080000000800000007669647300001000800000aa00389b71416a9b5a221ad111bad900609744111a00000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37}\FriendlyName = "SampleGrabber" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}\CLSID = "{C1F400A4-3F08-11D3-9F0B-006008039E37}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E1F1A0B8-BEEE-490D-BA7C-066C40B5E2B9}\Capabilities 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\FilterData = 02000000000040000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000700000003170693308000000000000000100000000000000000000003074793300000000800000009000000083eb36e44f52ce119f530020af0ba770e0cffa33bea9d011a52000a0d10129c07478747300001000800000aa00389b7100000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{42150CD9-CA9A-4EA5-9939-30EE037F6E74} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}\CLSID = "{4EB31670-9FC6-11CF-AF6E-00AA00B67A42}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FC772AB0-0C7F-11D3-8FF2-00A0C9224CF4}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330000000000000000010000000000000000000000307479330000000060000000800000006c175f45064bce479aef8caef73df7b500000000000000000000000000000000db271795ced2284596f63301fabb2de0 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}\CLSID = "{129D7E40-C10D-11D0-AFB9-00AA00B67A42}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\FriendlyName = "Wave Parser" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}\FilterData = 020000000000400001000000000000003070693308000000000000000100000000000000000000003074793300000000380000004800000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FA10746C-9B63-4B6C-BC49-FC300EA5F256}\CLSID = "{FA10746C-9B63-4B6C-BC49-FC300EA5F256}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\FriendlyName = "VGA 16 Color Ditherer" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C666E115-BB62-4027-A113-82D643FE2D99}\FriendlyName = "MPEG-2 Sections and Tables" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\CLSID = "{D51BD5A1-7548-11CF-A520-0080C77EF58A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{E2448508-95DA-4205-9A27-7EC81E723B1A} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{FA10746C-9B63-4B6C-BC49-FC300EA5F256}\FilterData = 02000000000020000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}\CLSID = "{70E102B0-5556-11CE-97C0-00AA0055595A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}\FilterData = 02000000000040000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{AD6C8934-F31B-4F43-B5E4-0541C1452F6F}\FilterData = 020000000000200002000000000000003070693300000000000000000100000000000000000000003074793300000000600000007000000031706933080000000000000001000000000000000000000030747933000000008000000070000000e1762af70aebd011ace40000c0cc16bae3762af70aebd011ace40000c0cc16ba898a8bb849b0804cadcf5898985e22c1 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}\CLSID = "{1643E180-90F5-11CE-97D5-00AA0055595A}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{C666E115-BB62-4027-A113-82D643FE2D99}\CLSID = "{C666E115-BB62-4027-A113-82D643FE2D99}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{AD6C8934-F31B-4F43-B5E4-0541C1452F6F} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{AD6C8934-F31B-4F43-B5E4-0541C1452F6F}\CLSID = "{AD6C8934-F31B-4F43-B5E4-0541C1452F6F}" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{AFB6C280-2C41-11D3-8A60-0000F81E0E4A}\FriendlyName = "MPEG-2 Demultiplexer" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{CD8743A1-3736-11D0-9E69-00C04FD7C15B} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{1f26a602-2b5c-4b63-b8e8-9ea5c1a7dc2e}\FriendlyName = "SBE2MediaTypeProfile" 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4}\FilterData = 02000000000020000000000000000000 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A74FBEB4-4539-9374-D9CA-00BC1507235D}\Instance\{48025243-2D39-11CE-875D-00608CB78066} 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exedescription pid process Token: 33 5056 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Token: SeIncBasePriorityPrivilege 5056 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Token: 33 5056 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe Token: SeIncBasePriorityPrivilege 5056 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exepid process 5056 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exedescription pid process target process PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe PID 376 wrote to memory of 5056 376 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe 2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_6c850ead2c8948bb6cf6bcfad01749a0_mafia.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5056