fb205cf114346ba554b3d33ce79c848b1637c5d83e2f5d027f11c8383b85cc84

General

Target

2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe
Size

464KB
MD5

0605cf5083652c65f7124c6034c63022
SHA1

1bb714088afe6dd3f0d28eca3f65c5b41aee2eeb
SHA256

fb205cf114346ba554b3d33ce79c848b1637c5d83e2f5d027f11c8383b85cc84
SHA512

9ca9502159d3406b5ca4e70dba51f0a76e399939f7139cc0018d5a87960e8c9cb1ab28b7a98e876c4f7747a32da8f07b83d4a582890472f6aa249998655b0f4a
SSDEEP

12288:zJrIik3vG4dm6/07tyX9yisA9yIw7UY9:zJrU3Zdm6DcA9yIiUY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

93D7.tmp

pid process

2824 93D7.tmp
Loads dropped DLL 1 IoCs

Processes:

2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe

pid process

1772 2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2824	93D7.tmp

pid	process
1772	2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2760 WINWORD.EXE
Suspicious behavior: RenamesItself 1 IoCs

Processes:

93D7.tmp

pid process

2824 93D7.tmp
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE

pid process

2760 WINWORD.EXE
2760 WINWORD.EXE
2760 WINWORD.EXE
2760 WINWORD.EXE
2760 WINWORD.EXE
2760 WINWORD.EXE

pid	process
2760	WINWORD.EXE

pid	process
2824	93D7.tmp

pid	process
2760	WINWORD.EXE
2760	WINWORD.EXE
2760	WINWORD.EXE
2760	WINWORD.EXE
2760	WINWORD.EXE
2760	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe93D7.tmp

description	pid	process	target process
PID 1772 wrote to memory of 2824	1772	2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe	93D7.tmp
PID 1772 wrote to memory of 2824	1772	2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe	93D7.tmp
PID 1772 wrote to memory of 2824	1772	2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe	93D7.tmp
PID 1772 wrote to memory of 2824	1772	2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe	93D7.tmp
PID 2824 wrote to memory of 2760	2824	93D7.tmp	WINWORD.EXE
PID 2824 wrote to memory of 2760	2824	93D7.tmp	WINWORD.EXE
PID 2824 wrote to memory of 2760	2824	93D7.tmp	WINWORD.EXE
PID 2824 wrote to memory of 2760	2824	93D7.tmp	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\93D7.tmp
"C:\Users\Admin\AppData\Local\Temp\93D7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.exe DB692745B495C64A5844410D819F91D144C64FD30F63AE6CC6F227396E02F266B569F40AD6BB47CF9D76F504217FFE87BB493955AD222E5BB69DADECE7DDE817
2⤵
- Executes dropped EXE
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2824

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.docx"
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2760

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-04-23_0605cf5083652c65f7124c6034c63022_mafia.docx
Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
\Users\Admin\AppData\Local\Temp\93D7.tmp
Filesize
464KB

MD5
a947cc48a63e1208b185cd74b68c38c4

SHA1
370064c3566d97301a19d2233a76240c46473f6f

SHA256
b3afdf92e7e6516b80ba5ea73faea91937ca072c6a79ad812cb0822ae12f318a

SHA512
4a7554326c52a73b8582c1adb2ede4788361858de0d7cfccb3b91130abebf3dfd13929e28f433bc5d1f97829241e7174ce4ef61f33832aa8803f8037f2139b4e

Download Submit
memory/2760-7-0x000000002FB21000-0x000000002FB22000-memory.dmp

Filesize
4KB

Download
memory/2760-8-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2760-9-0x0000000070ADD000-0x0000000070AE8000-memory.dmp

Filesize
44KB

Download
memory/2760-13-0x0000000070ADD000-0x0000000070AE8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing