Overview

overview

6

Static

static

1

2024-03-13...ia.exe

windows7-x64

6

2024-03-13...ia.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 09:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-13_ac25fb67b8816ff495befbd417164406_mafia.exe

  • Size

    1.1MB

  • MD5

    ac25fb67b8816ff495befbd417164406

  • SHA1

    02ed508f0f255f0dab0c92a954d1230cb3e16c1d

  • SHA256

    db60d03ed07d1ff045b43408b12a9b8b05b2add660542ed41311592fca41473a

  • SHA512

    e2b7e18635d1da37a5ae3660e0dc9d8585a4a518aaf711c950ff19d267227d071e32c8d9633b3ce993c910f5cac43a5ad07859327d3745f878bbd7a19fb9b04f

  • SSDEEP

    24576:+t8U5uR/VpAzKdA7NxL3da6SJ4/1YQYKq6bIm6gQJgk87B2f:nUXAMLNa6SJ4/1iKq6bIm6gQJgk87B2f

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac25fb67b8816ff495befbd417164406_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-13_ac25fb67b8816ff495befbd417164406_mafia.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:4632
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:740

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Public\Documents\Baidu\Common\I18N\conf.db
            Filesize

            403B

            MD5

            b136217eb9751e10eae9b838116c3130

            SHA1

            ff026b3ef3cd8100311f0d158bdcf4787dc3eaf6

            SHA256

            6de15f843b4532b0a0bc3495c15af20a533a5ea6fffd9fce68c04968016497b7

            SHA512

            8ab314b748e528d68656f5b301c04787b619e3c1fb902b1e376efe433657f7fbdcbba3b117c59670ff1dbac5194187d793f90f52cd3a68940d794029018377a7

            Download Submit

          • memory/4632-9-0x00000000010B0000-0x00000000010B1000-memory.dmp

            Filesize

            4KB

            Download