Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 09:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe
-
Size
2.2MB
-
MD5
f1ad3bd54bc2ff3fb9f5d25d9605dba2
-
SHA1
15d83ca14a6505cdfeb87a951c090884b63d0bc3
-
SHA256
d5d93c16e74027afd84610ec711cf044f2ecd169e56995ae6ce6458c6b7588fc
-
SHA512
e727bff8f22ccdae8b5354c6909648cfe1371ffc4e74d009db454dda1ba43d3d958ff09ae956868599cb828c2bc40627170f5b39cf9fe5bb727d4d48ed427bb6
-
SSDEEP
49152:lLsn72aV8QvTOXNvOy5tJA9c7KCqL9Xb6u/D9IMh:lLCiaEZOa+NYu/mMh
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe -
Modifies registry class 5 IoCs
Processes:
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C60EF9F-E190-C5E7-CBDF-08F13EAA6576} 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C60EF9F-E190-C5E7-CBDF-08F13EAA6576}\ = "Voice Activation Manager 2 Class" 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C60EF9F-E190-C5E7-CBDF-08F13EAA6576}\InProcServer32 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C60EF9F-E190-C5E7-CBDF-08F13EAA6576}\InProcServer32\ = "%SystemRoot%\\SysWow64\\VoiceActivationManager.dll" 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C60EF9F-E190-C5E7-CBDF-08F13EAA6576}\InProcServer32\ThreadingModel = "Both" 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exedescription pid process Token: 33 5068 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe Token: SeIncBasePriorityPrivilege 5068 2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_f1ad3bd54bc2ff3fb9f5d25d9605dba2_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5068