0405c1498334674079e48358702da47bd387f9a8ea29a04ef4d91fd6cd36f85d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Size

834KB
MD5

58f5a13b4aa5c8f842f3251a5e38dd17
SHA1

b32df71c9ea192b0b01746006d19c4fff978d898
SHA256

0405c1498334674079e48358702da47bd387f9a8ea29a04ef4d91fd6cd36f85d
SHA512

0519ea8887bbaa97d5dbcd9c05bdcc006459b3b757c98053ec1e102e41e75b87bfe24f9f9b2e0a186dee417812a838cea3373b7ed40862b672cd808c9305eb93
SSDEEP

24576:wmWZuw4sX2LM2y1yxXlmf7ICkBUKd47iJ:wm2wPLYWXAjIxd47

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2884	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\" self-delete"	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\""	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2596	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2680	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2612	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2884	2612	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	28
PID 2612 wrote to memory of 2884	2612	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	28
PID 2612 wrote to memory of 2884	2612	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	28
PID 2612 wrote to memory of 2884	2612	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	28
PID 2884 wrote to memory of 2596	2884	cmd.exe	30
PID 2884 wrote to memory of 2596	2884	cmd.exe	30
PID 2884 wrote to memory of 2596	2884	cmd.exe	30
PID 2884 wrote to memory of 2596	2884	cmd.exe	30
PID 2884 wrote to memory of 2680	2884	cmd.exe	32
PID 2884 wrote to memory of 2680	2884	cmd.exe	32
PID 2884 wrote to memory of 2680	2884	cmd.exe	32
PID 2884 wrote to memory of 2680	2884	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c taskkill /pid 2612 & for /l %x in (1,1,60) do ping 127.0.0.1 -n 2 -w 500 & del /q "C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe" exit
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /pid 2612
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2 -w 500
    3⤵
    - Runs ping.exe
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads