ec85abcc195013fa26d00d6182d8062185e61641b60f66b5406688ce05f56b86

General

Target

2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
Size

2.9MB
MD5

43acf31121823c414a7c9668334c00f7
SHA1

32cb6b3c82aaad667abbfff46328929babf10ea3
SHA256

ec85abcc195013fa26d00d6182d8062185e61641b60f66b5406688ce05f56b86
SHA512

baa7a57e7b0ce42ef8420a837f774a81a09af81184bb83891513bae3d36b7f5e93a9778ff90a094a506124406a34fca7b8cc0b5354429e2a326f27e3a97fa1f8
SSDEEP

49152:NqSNIHnAt2WZxJuBuNYSNcKxVjakEAGv3d+7KSiVXHIBP1h5ZE1owaHNAEl2/C9+:/OHu2WZxJuBuNYYxVjvEAGv3d+7KSiVP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
592	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 592	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	28
PID 2180 wrote to memory of 592	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	28
PID 2180 wrote to memory of 592	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	28
PID 2180 wrote to memory of 592	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	28
PID 2180 wrote to memory of 324	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	29
PID 2180 wrote to memory of 324	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	29
PID 2180 wrote to memory of 324	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	29
PID 2180 wrote to memory of 324	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	29
PID 324 wrote to memory of 988	324	cmd.exe	32
PID 324 wrote to memory of 988	324	cmd.exe	32
PID 324 wrote to memory of 988	324	cmd.exe	32
PID 324 wrote to memory of 988	324	cmd.exe	32
PID 2180 wrote to memory of 1008	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	33
PID 2180 wrote to memory of 1008	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	33
PID 2180 wrote to memory of 1008	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	33
PID 2180 wrote to memory of 1008	2180	2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe	33
PID 1008 wrote to memory of 2948	1008	cmd.exe	35
PID 1008 wrote to memory of 2948	1008	cmd.exe	35
PID 1008 wrote to memory of 2948	1008	cmd.exe	35
PID 1008 wrote to memory of 2948	1008	cmd.exe	35
PID 592 wrote to memory of 2880	592	powershell.exe	37
PID 592 wrote to memory of 2880	592	powershell.exe	37
PID 592 wrote to memory of 2880	592	powershell.exe	37
PID 592 wrote to memory of 2880	592	powershell.exe	37

C:\Users\Admin\AppData\Local\Temp\2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_43acf31121823c414a7c9668334c00f7_mafia.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start /b reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\game.exe" /t REG_SZ /d "~ 16BITCOLOR" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\game.exe" /t REG_SZ /d "~ 16BITCOLOR" /f
    3⤵
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start /b reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\game.exe" /t REG_SZ /d "DisableNXShowUI" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\game.exe" /t REG_SZ /d "DisableNXShowUI" /f
    3⤵
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
89e80d5d255291d44a0d5e64f640bc6b

SHA1
50061b60dc5364e10bf9c46de6b6a332bdd4a941

SHA256
82f96191322a6a68722c001ed5608d1943804cda47c7034906f92d74e2ec8a61

SHA512
21c17a8c9f5206675f275193a4179c07f050f64ebbdb1c54d50b371a7f7919588feef3501675b909356828be6e0322e398033be7662732e6bfba253173896842

Download Submit
memory/592-3-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download
memory/592-4-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download
memory/592-5-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/592-6-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/592-16-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download
memory/2880-13-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2880-12-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download
memory/2880-14-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download
memory/2880-15-0x0000000073750000-0x0000000073CFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing