Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe
-
Size
187KB
-
MD5
396023ae937d9cd7eea28c981d595c98
-
SHA1
955f83d2ac25ef84fc38259bcb8349746693009c
-
SHA256
eaa0ba0b04296242c84fc293b1e875489516109a414088b897bfa33559084331
-
SHA512
b9c3b82b8e64062d64e32752904afbfb24f0698babeb0035eaa761111285b948aeccbfb42b8ca95094de6349c5a99eda4309a15e3c728fffd3e2b30256cbc3dc
-
SSDEEP
3072:uLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6dvn3mxIOUGCH:e83YLmUOFXEEZnRCI3AXny/Hj8LG4ujI
Malware Config
Signatures
-
Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral1/files/0x000c00000001227b-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/328-3-0x0000000000CD0000-0x0000000000CD9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2208-52-0x0000000000CD0000-0x0000000000CD9000-memory.dmp INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c00000001227b-5.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2208 zJoKwe.exe -
Loads dropped DLL 2 IoCs
pid Process 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe zJoKwe.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{7ADE9966-696F-4996-9E1A-1D7786573DA1}\chrome_installer.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE zJoKwe.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe zJoKwe.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe zJoKwe.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe zJoKwe.exe File opened for modification C:\Program Files\7-Zip\7z.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE zJoKwe.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe zJoKwe.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe zJoKwe.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe zJoKwe.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe zJoKwe.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe zJoKwe.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe zJoKwe.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe zJoKwe.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe zJoKwe.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE zJoKwe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE zJoKwe.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe zJoKwe.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe zJoKwe.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe zJoKwe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 328 wrote to memory of 2208 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe 29 PID 328 wrote to memory of 2208 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe 29 PID 328 wrote to memory of 2208 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe 29 PID 328 wrote to memory of 2208 328 2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe 29 PID 2208 wrote to memory of 2652 2208 zJoKwe.exe 30 PID 2208 wrote to memory of 2652 2208 zJoKwe.exe 30 PID 2208 wrote to memory of 2652 2208 zJoKwe.exe 30 PID 2208 wrote to memory of 2652 2208 zJoKwe.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_396023ae937d9cd7eea28c981d595c98_mafia_wapomi.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\Temp\zJoKwe.exeC:\Users\Admin\AppData\Local\Temp\zJoKwe.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\085e41c5.bat" "3⤵PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5f6a292f5d2500de41d66a7e4b8cd9b42
SHA19faf22c9c50cb35816a4a602ffc979c15c55bec7
SHA256765070d1e3acfeca830a95f56bc05b82e622ba4bf77222f9edf8d2580d3d37b4
SHA512d1f179c1ec80095a481a28be89183d8076056818a3903a3324d7e726bdb7e35778fb50899eedd94cdecd6af55d5227fcbceac24abdeae192dc7e48389228189a
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e