639c5812eeeac904214b3dd24a55f1f6e9f7ce29c1d0111083d26994176bc0ca

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe
Size

2.7MB
MD5

3424ec8ba367c220da14b7320ce001ae
SHA1

48bfa9bd8f53ed15ccc7141c334c7a88f8ce0fa3
SHA256

639c5812eeeac904214b3dd24a55f1f6e9f7ce29c1d0111083d26994176bc0ca
SHA512

f639ed0538c7f43d2571af2d96f633aaee3799a5a20d00bbf043a63c8e4739ccc559bff91a424dc6613b435af3e0c2fcd96017e357a324c405fa71aa6468f2a0
SSDEEP

49152:hXx8IfTeZp91wMRsyhEntgfV2sOIcOG/ReNYb6Xfc7hHQ/qmBRem7owQ0R77i+4P:hiIreZ1wMRdE+fV2sOIcOG/ReJc7hHQa

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GameProtect = "C:\\Users\\Admin\\AppData\\Local\\Temp\\×Ô¶¯¸üÐÂ.bat"	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe
2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2204	2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe	28
PID 2408 wrote to memory of 2204	2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe	28
PID 2408 wrote to memory of 2204	2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe	28
PID 2408 wrote to memory of 2204	2408	2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3424ec8ba367c220da14b7320ce001ae_mafia.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\reg.exe
  reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v GameProtect /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\×Ô¶¯¸üÐÂ.bat" /f
  2⤵
  - Adds Run key to start application
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads