a0a31e57410db248b7744018087045b3bcc86aee82f6db32d9322d0d753d49b1

General

Target

2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe
Size

486KB
MD5

0b92147c7be4916b81686d6ef5aaf5cf
SHA1

2c45fb724dbf81adfab2acbf38dd06b00a4e2cf7
SHA256

a0a31e57410db248b7744018087045b3bcc86aee82f6db32d9322d0d753d49b1
SHA512

31dc791aac4e4cb8de61d423cb023d0d5f8fc22cfaad93dfae65fcda5812d6cd72606e16cdd5df9288baf0908bd9e28320e46a5bdd65a45991520e69ec1303f7
SSDEEP

6144:pRPu8zwvAZsCZrIik3tHDvBE+2qgrYhpT00ZiKNvHyyRZiaafI9sH2fB:pTrIik35BE+R8YnpiuvroVUB

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	2971.tmp

Executes dropped EXE 1 IoCs

pid	Process
2492	2971.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings	2971.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3536	WINWORD.EXE
3536	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2492	2971.tmp

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE
3536	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2492	4368	2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe	86
PID 4368 wrote to memory of 2492	4368	2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe	86
PID 4368 wrote to memory of 2492	4368	2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe	86
PID 2492 wrote to memory of 3536	2492	2971.tmp	91
PID 2492 wrote to memory of 3536	2492	2971.tmp	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\2971.tmp
  "C:\Users\Admin\AppData\Local\Temp\2971.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.exe 8F14EE60A9D1DA7DA9B554D977FD52CF65EA1D5CCDF81565068D959090FBEEEDA8999F8A139DA00E7AB43E13547FDACAD479A535CEA6DA18E9726D51EE7DA913
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-04-23_0b92147c7be4916b81686d6ef5aaf5cf_mafia.docx

Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2971.tmp

Filesize
486KB

MD5
40db83e4c639837f1a79bf6630d10bfc

SHA1
a71bf639a6a0d66b000d1d003cfa44bb56c7884e

SHA256
dd17e6a908557a9a85b6af69df3a5ef98e81dc3b7f799d01f8d8e8d4f16dee3d

SHA512
60425dd5e57874effbfb5dcbc8f480f6cc5a4b690e109d1b8fd1d9d23cf650219eb3ee9284df5a8f083a6f6818f2def65dfeca7ddf178055828e91abb09f0d73

Download Submit
memory/2492-6-0x0000000000AA0000-0x0000000000B22000-memory.dmp

Filesize
520KB

Download
memory/2492-12-0x0000000000AA0000-0x0000000000B22000-memory.dmp

Filesize
520KB

Download
memory/3536-21-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-24-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-13-0x00007FFB75C10000-0x00007FFB75C20000-memory.dmp

Filesize
64KB

Download
memory/3536-14-0x00007FFB75C10000-0x00007FFB75C20000-memory.dmp

Filesize
64KB

Download
memory/3536-15-0x00007FFB75C10000-0x00007FFB75C20000-memory.dmp

Filesize
64KB

Download
memory/3536-16-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-17-0x00007FFB75C10000-0x00007FFB75C20000-memory.dmp

Filesize
64KB

Download
memory/3536-18-0x00007FFB75C10000-0x00007FFB75C20000-memory.dmp

Filesize
64KB

Download
memory/3536-19-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-20-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-52-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-22-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-23-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-35-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-25-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-27-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-26-0x00007FFB73AB0000-0x00007FFB73AC0000-memory.dmp

Filesize
64KB

Download
memory/3536-28-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-29-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-30-0x00007FFB73AB0000-0x00007FFB73AC0000-memory.dmp

Filesize
64KB

Download
memory/3536-31-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-32-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-33-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-34-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/3536-36-0x00007FFBB5B90000-0x00007FFBB5D85000-memory.dmp

Filesize
2.0MB

Download
memory/4368-4-0x0000000000920000-0x00000000009A2000-memory.dmp

Filesize
520KB

Download
memory/4368-0-0x0000000000920000-0x00000000009A2000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads