Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27/05/2024, 00:34
General
-
Target
2024-05-27_86fc81c02fca59f6ec4a776559c44120_mafia.exe
-
Size
447KB
-
MD5
86fc81c02fca59f6ec4a776559c44120
-
SHA1
8d4a9bae1cb62b93708a35f5325d7afb5dd08f6a
-
SHA256
9124b063040bddffce50a5b767fd45254a7ab24cba65bff7da2e73a9f2f30407
-
SHA512
4d3bdff5fb54caab35e0fb78c7bd2eaf15ec64bb769d3493c0fa53632e339a038fdeaab4d6b0c656b339d71356234b17c375890f959f9c23d4921ac66ab97f68
-
SSDEEP
12288:w/rYpa1hoj5jsRObPBvlpqznW8VKN3ubY1:wzYpacj5gRObP93qzChubS
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_86fc81c02fca59f6ec4a776559c44120_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_86fc81c02fca59f6ec4a776559c44120_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2024-05-27_86fc81c02fca59f6ec4a776559c44120_mafia.exe 9A6B94B49568EE4F937B977FDA645CA0F8FEC0177908EE01FF89E180D615E152769A54ACDCCBE3C60B80868ADC0D02890F9D441C79DA0BCB6E9A984CB556BD772⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2024-05-27_86fc81c02fca59f6ec4a776559c44120_mafia.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5154788a16dea87853dfcbd117f849b55
SHA17d36995eb72700adf612129d558b5ace385d672f
SHA2560bc7a2c149ae6ddb143281c277785f10fda4ff6a75c6c73b862108ee22aafa75
SHA5125ad5a1a841c5b39f161a9b8bd929a16d21777289e07c10e8cf867e03a78471a5695e806b541569101c41a8bd01b551cb7f06d1ce01b99f2d72bd9994b6cca79e
-
Filesize
447KB
MD52bf71cdcf0400af55a622059f5eb77bc
SHA1128a3a5e980ff84398d880ad7b9959e484c4cf2e
SHA2561a48082704f1a6988b95224ffb864ae3183c80733138351d1fb7050cfa07706e
SHA5129eb07fdd333073bd5458a56b5302e55608717590e472afe9a41537196a09b99f1d0f190b654bf0bf24b8cb51189ed81af5ce47433465b1816124065a648a7681
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB