Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
22/05/2024, 06:09
General
-
Target
2024-05-22_f05ef3a4355ed9d714721abb315b4f5c_mafia.exe
-
Size
4.1MB
-
MD5
f05ef3a4355ed9d714721abb315b4f5c
-
SHA1
3d5d85d13c714d1965036e1008deeee6e8865f31
-
SHA256
6dd11ee7f581910dc38e2781af97abdfa554a3f97939d7236d3e92aa5b9a9cb7
-
SHA512
bb524b87a1ad5502f918ded22e9b09639832750be5a8a065f4bfc0745a3be8a2c7199f4c9e0f8ea3ce148f2bbd1037acd85ff8489425c4406eb15f8fac1e854b
-
SSDEEP
98304:ET9KtT11R/ARWko3AM7NdQFCzgQrRpywW:F1L/AUkoQQNmAzgPf
Score
9/10
Malware Config
Signatures
-
Detects executables packed with VMProtect. 14 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_f05ef3a4355ed9d714721abb315b4f5c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_f05ef3a4355ed9d714721abb315b4f5c_mafia.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB