0307cfe4b59db89a314aaacf79998ae1b67c5f5d331bc2e0521f9e0da81fa788

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 05:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe
Size

476KB
MD5

062cd9ca7fd185a76f05fbd4c92dacbc
SHA1

924fb28fcff445e4edc1543f1f3d3b6fa69ac94d
SHA256

0307cfe4b59db89a314aaacf79998ae1b67c5f5d331bc2e0521f9e0da81fa788
SHA512

eadda42ea6f2697252381d0b2492c7a5871cad361399132c8de56f111f20f4282c9ce1dcd8b3fdbd52c692258f107bfe4722fdf5b1481ce03ff555eec23151f3
SSDEEP

12288:aO4rfItL8HRe6Ll5rR6v0ERBCrm8IbH2tXR7K9wlsDpVFd:aO4rQtGRR5rwsER4rm8Iath+9wlsDpVT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4412	35F4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4412	35F4.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3672	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4412	2992	2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe	89
PID 2992 wrote to memory of 4412	2992	2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe	89
PID 2992 wrote to memory of 4412	2992	2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\35F4.tmp
  "C:\Users\Admin\AppData\Local\Temp\35F4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-03-14_062cd9ca7fd185a76f05fbd4c92dacbc_mafia.exe 735906C8A7CFA4D2A94110F2728545509AB68B090D69C599C64DE35A21E60B7B695ADFCC258065F44D853113914990A0BCDD2E5C94003A4687215577640237C3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4412

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
c0836fb97638c10f64443dc76119ce48

SHA1
bc1710e7d389623f95172d22c2c8404c3881a819

SHA256
3bdd22baa271a3c1fa580a4d2651a958c4195928a6d3a0af1b759d28a33514f3

SHA512
c6c5479e98cb0d5f961fd8cab667f5cd6c62436cc86afd2e883e0e30fbc27c80b468fcdc2bfba803642c9c171a42487b9300099e094af0b61fbbb133629d2620

Download Submit
C:\Users\Admin\AppData\Local\Temp\35F4.tmp

Filesize
476KB

MD5
5360f02fc15651256a0e170fb8fc2ffb

SHA1
2f25a471ee14c9b359dd3f191da2adbdeba3b50f

SHA256
a7c754651d38fac29249efd1cb6f1f34172f635e2519190dab955075389ab17f

SHA512
d7f5c9f04850433086e1aeb25f6a85f909ee00a381dfde3086dabdd5e54b849b4b8ff7248e72f60cfcb7e184aee7d6ffd7e18432f3f3cbec81847fba9a289c7e

Download Submit
memory/3672-45-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-46-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-37-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-38-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-39-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-40-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-41-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-42-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-43-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-47-0x000001D93A710000-0x000001D93A711000-memory.dmp

Filesize
4KB

Download
memory/3672-36-0x000001D93AAC0000-0x000001D93AAC1000-memory.dmp

Filesize
4KB

Download
memory/3672-20-0x000001D932540000-0x000001D932550000-memory.dmp

Filesize
64KB

Download
memory/3672-44-0x000001D93AAF0000-0x000001D93AAF1000-memory.dmp

Filesize
4KB

Download
memory/3672-48-0x000001D93A700000-0x000001D93A701000-memory.dmp

Filesize
4KB

Download
memory/3672-50-0x000001D93A710000-0x000001D93A711000-memory.dmp

Filesize
4KB

Download
memory/3672-53-0x000001D93A700000-0x000001D93A701000-memory.dmp

Filesize
4KB

Download
memory/3672-56-0x000001D93A640000-0x000001D93A641000-memory.dmp

Filesize
4KB

Download
memory/3672-4-0x000001D932440000-0x000001D932450000-memory.dmp

Filesize
64KB

Download
memory/3672-68-0x000001D93A840000-0x000001D93A841000-memory.dmp

Filesize
4KB

Download
memory/3672-70-0x000001D93A850000-0x000001D93A851000-memory.dmp

Filesize
4KB

Download
memory/3672-71-0x000001D93A850000-0x000001D93A851000-memory.dmp

Filesize
4KB

Download
memory/3672-72-0x000001D93A960000-0x000001D93A961000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads