7d5b94df3147e1d0331005c0f08a5bea4a80805f1078d2f7e40fb912609cc0d2

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 11:31

Target

2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe
Size

412KB
MD5

432b8407354855a7089a820140d7b784
SHA1

77c09450743edcb8bc1f62f86e1f7b6ed4e2dab6
SHA256

7d5b94df3147e1d0331005c0f08a5bea4a80805f1078d2f7e40fb912609cc0d2
SHA512

84378fc11b5b12fa055176b6334c7fee37ac0c3a85edca189808516c710b5b16ccbd5052a12b2a6013c19c2e23478d0dbd9eae2d55cfd4d44ae9f1fde554c388
SSDEEP

12288:U6PCrIc9kph5y/Cyh8g4sZSJWWeqzpjAEe1yZx:U6QIcOh5yaDTnJWWeqzpMET

Score

7^/10

Deletes itself 1 IoCs

pid	Process
512	6D21.tmp

Executes dropped EXE 1 IoCs

pid	Process
512	6D21.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4696	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 512	436	2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe	93
PID 436 wrote to memory of 512	436	2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe	93
PID 436 wrote to memory of 512	436	2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\6D21.tmp
  "C:\Users\Admin\AppData\Local\Temp\6D21.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2024-04-09_432b8407354855a7089a820140d7b784_mafia.exe CEB3B8E5928F756E3515AD2B598DA9EA7FBB4C0CC3AF6AEDF3F3C45990E0E11EE7B85042DA240D9E404DE7CD0DACC5B9E0D645C3E52C9E85549CD07BFD609A37
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:8
1⤵
PID:1300

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Users\Admin\AppData\Local\Temp\6D21.tmp

Filesize
412KB

MD5
2535f08c86876b63baa44c291cfb6155

SHA1
27d4729adb746bd26773bff4a9d2cb9881b70af9

SHA256
dd97fd26e55bc0337c494843cbb5b0b4946e101353a34bbd97fb9218f883d91d

SHA512
ce712fd04971adc2e5b997ee682681cd2d0366de6f8e1e7f3be97fc73f37ba38ee3873a5f607dc6a1b105c46947b7153f610b95c717898c43aea4918a2f44e4c

Download Submit
memory/4696-4-0x00000226AD070000-0x00000226AD080000-memory.dmp

Filesize
64KB

Download
memory/4696-20-0x00000226AD170000-0x00000226AD180000-memory.dmp

Filesize
64KB

Download
memory/4696-36-0x00000226B54E0000-0x00000226B54E1000-memory.dmp

Filesize
4KB

Download
memory/4696-38-0x00000226B5510000-0x00000226B5511000-memory.dmp

Filesize
4KB

Download
memory/4696-39-0x00000226B5510000-0x00000226B5511000-memory.dmp

Filesize
4KB

Download
memory/4696-40-0x00000226B5620000-0x00000226B5621000-memory.dmp

Filesize
4KB

Download