257ddc3b9dd03436d3158994021f0b95d4bede505ab8bf61ca254cc00777d753

General

Target

2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe
Size

462KB
MD5

d599db5f0d8ae7ff83bee1f89b7f398e
SHA1

bddd5785c671930c1e77bffbdf1dc4a89c2dc118
SHA256

257ddc3b9dd03436d3158994021f0b95d4bede505ab8bf61ca254cc00777d753
SHA512

569f8b2619ad89db2b7518f6748b48f6bce2e3fe3338b02fc1055bb06533cdd432fb03b07924c79b7856879698fb30d1a8cb368c0132daa7782504a9d0d4411d
SSDEEP

6144:lA4psmawWIrFUJe5X8bbUDsQvakk7GdI9AhyJEdiHUL7ewiW/DvjsHOj:loJe5X8busN8dxyG7e5+Dvouj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2952	1DAE.tmp

Loads dropped DLL 1 IoCs

pid	Process
2524	2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2532	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2952	1DAE.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE
2532	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2952	2524	2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe	28
PID 2524 wrote to memory of 2952	2524	2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe	28
PID 2524 wrote to memory of 2952	2524	2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe	28
PID 2524 wrote to memory of 2952	2524	2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe	28
PID 2952 wrote to memory of 2532	2952	1DAE.tmp	29
PID 2952 wrote to memory of 2532	2952	1DAE.tmp	29
PID 2952 wrote to memory of 2532	2952	1DAE.tmp	29
PID 2952 wrote to memory of 2532	2952	1DAE.tmp	29

C:\Users\Admin\AppData\Local\Temp\2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\1DAE.tmp
  "C:\Users\Admin\AppData\Local\Temp\1DAE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.exe D0A4DE3C306D5331CBF90152C8E6B4F04AA87EC6613644645647F1352F61F3B9C089191DB72300CA2C35240EC69D40930BA9AECC91124C8C8ADA2D3BFAFFA923
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.docx"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-03-13_d599db5f0d8ae7ff83bee1f89b7f398e_mafia.docx

Filesize
140KB

MD5
e90e498009a13ae957dcde4e01065e7d

SHA1
dcb4cc9b7d1ed3becc625597422d60aaf068a759

SHA256
ca91bbd477e2a516997c48dde3da1a5eae4cad86ca664fea54f0103739073c94

SHA512
4d0868f653e6c57d4011430ab81688f4f039550a9a0b5b1ce5ab1a695cb1dca7d7cdfb1d7c3920c35bbd3a8b441c820f00ae4e71f749650545ddd6894d597766

Download Submit
\Users\Admin\AppData\Local\Temp\1DAE.tmp

Filesize
462KB

MD5
b0bfb57a99b91c15072fcce5e0dd600c

SHA1
5dab1b430bed4b1d5a30ea54286a123bef9a504f

SHA256
d969e064b7418132097b43670959923e463b202b83982a829efc8dcf6b87e926

SHA512
b5e84b013bec82c593d10bf8ce51e10ed5401cfc522305ac8a3ff05cdeadac6649a1bb808987d9cf403ad7b390478f1ae861e06622f0b267a8fb62e392b9e765

Download Submit
memory/2532-7-0x000000002F541000-0x000000002F542000-memory.dmp

Filesize
4KB

Download
memory/2532-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2532-9-0x00000000711AD000-0x00000000711B8000-memory.dmp

Filesize
44KB

Download
memory/2532-13-0x00000000711AD000-0x00000000711B8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing