92dfdeb17671b79596fce3ea2978ad5d026e752c219297d46c4ffbe74487d97c

General

Target

2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Size

1.1MB
MD5

f82b197b2cf481234c51121f9f168b28
SHA1

20e27d39adbe3680fe2310baecffa906e638a8e5
SHA256

92dfdeb17671b79596fce3ea2978ad5d026e752c219297d46c4ffbe74487d97c
SHA512

fe5e91e014219b924b14197e96b997e96d07dce28a25fa2ac1387841a112239c5b7196a95af35a95b395dde9ea3b74b33ec35050d71bc5e1f999ea3c3094d3fc
SSDEEP

24576:yKoBPMgHVnkYV0ZD2ovobLzB/3gQvExFpdhC55AKDqsc53vT3v7vliHA:yj/HVnWZK7B/gkUrMvLqscV3v7vwA

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral1/memory/2216-3-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-44-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-45-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-46-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-48-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-51-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-53-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX
behavioral1/memory/2216-56-0x0000000074840000-0x0000000074A1C000-memory.dmp	UPX

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-3-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-44-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-45-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-46-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-48-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-51-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-53-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx
behavioral1/memory/2216-56-0x0000000074840000-0x0000000074A1C000-memory.dmp	upx

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2216	2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_f82b197b2cf481234c51121f9f168b28_mafia.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
memory/2216-3-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-4-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2216-44-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-45-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-46-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-48-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-51-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-53-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download
memory/2216-56-0x0000000074840000-0x0000000074A1C000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads