0405c1498334674079e48358702da47bd387f9a8ea29a04ef4d91fd6cd36f85d

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 10:24

Target

2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Size

834KB
MD5

58f5a13b4aa5c8f842f3251a5e38dd17
SHA1

b32df71c9ea192b0b01746006d19c4fff978d898
SHA256

0405c1498334674079e48358702da47bd387f9a8ea29a04ef4d91fd6cd36f85d
SHA512

0519ea8887bbaa97d5dbcd9c05bdcc006459b3b757c98053ec1e102e41e75b87bfe24f9f9b2e0a186dee417812a838cea3373b7ed40862b672cd808c9305eb93
SSDEEP

24576:wmWZuw4sX2LM2y1yxXlmf7ICkBUKd47iJ:wm2wPLYWXAjIxd47

Score

7^/10

persistence

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\""	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe\" self-delete"	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3316	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2268	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe
3884	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3204	3884	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	100
PID 3884 wrote to memory of 3204	3884	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	100
PID 3884 wrote to memory of 3204	3884	2024-03-09_58f5a13b4aa5c8f842f3251a5e38dd17_mafia.exe	100
PID 3204 wrote to memory of 3316	3204	cmd.exe	102
PID 3204 wrote to memory of 3316	3204	cmd.exe	102
PID 3204 wrote to memory of 3316	3204	cmd.exe	102
PID 3204 wrote to memory of 2268	3204	cmd.exe	104
PID 3204 wrote to memory of 2268	3204	cmd.exe	104
PID 3204 wrote to memory of 2268	3204	cmd.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2032