a1fdb1cd4eb27032a94a479025d8505be2d0130b5fa8b18fe7f027829d120a99

General

Target

2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
Size

4.8MB
MD5

0c271d77805e847b54c586d691f59130
SHA1

ba17413a67cef8d05584da2e4b763a8daf6e34b1
SHA256

a1fdb1cd4eb27032a94a479025d8505be2d0130b5fa8b18fe7f027829d120a99
SHA512

38631609f402cb197cacaa187167ee73ef4723b6bc89f2df7949b9b621ee4c8ea31c581e48527f258dd360c74be885b383f3fec00fb023685db1e6d5af4621da
SSDEEP

98304:35J+E0SCxIk7zumFWAs/fyIgdElb3EIaFFpPVKh9uN8L4c7eBoLbL5w7APXLAYTi:JYE0SCI4rbECIwBbiL4c7NL8X

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
240	2700	WerFault.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2284	PING.EXE
2892	PING.EXE
332	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2284	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	28
PID 2700 wrote to memory of 2284	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	28
PID 2700 wrote to memory of 2284	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	28
PID 2700 wrote to memory of 2284	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	28
PID 2700 wrote to memory of 240	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	32
PID 2700 wrote to memory of 240	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	32
PID 2700 wrote to memory of 240	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	32
PID 2700 wrote to memory of 240	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	32
PID 2700 wrote to memory of 2892	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	31
PID 2700 wrote to memory of 2892	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	31
PID 2700 wrote to memory of 2892	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	31
PID 2700 wrote to memory of 2892	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	31
PID 2700 wrote to memory of 332	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	33
PID 2700 wrote to memory of 332	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	33
PID 2700 wrote to memory of 332	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	33
PID 2700 wrote to memory of 332	2700	2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe	33

C:\Users\Admin\AppData\Local\Temp\2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_0c271d77805e847b54c586d691f59130_mafia.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\System32\PING.EXE" www.baidu.com -n 2
  2⤵
  - Runs ping.exe
  PID:2284
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\System32\PING.EXE" www.baidu.com -n 2
  2⤵
  - Runs ping.exe
  PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1480
  2⤵
  - Program crash
  PID:240
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\System32\PING.EXE" www.baidu.com -n 2
  2⤵
  - Runs ping.exe
  PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mac277E.tmp

Filesize
335B

MD5
f0ec4dd4f88fcb2c3174b2f0d3f73d89

SHA1
69f18c94c71b6ddc3b5e71c3eae4eb3ab8b9de7b

SHA256
de8c437bd2e829a1bca66f4d26ec60138cbfa35dd6a0e04058acb84ffd1b8cb3

SHA512
da3651bda4516dc0c7c9eacbeaceb3e8dfff5e7bb680a566f04c2a2f32ddc414bc4fc9e69d70f499f4f79fa4138880234001320c8d698f0e4447fc41b170ec98

Download Submit

Analysis

Sharing