Analysis
-
max time kernel
132s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31-05-2024 06:03
General
-
Target
2024-05-31_3a4759965eae91a95e63c16fc044f569_mafia.exe
-
Size
3.6MB
-
MD5
3a4759965eae91a95e63c16fc044f569
-
SHA1
9d190a7edd123b9eec0c288f6014aa06992ca439
-
SHA256
73f8bb0ed867c930d6d8df6c6bf9684ebbc1b7776076caadd431df2672151a71
-
SHA512
3e50525660cbd32d944a9929d88415b8d81a125a97d1031d9e2863916860eb0fa3f0bf3aa0d651313b6785a2961cd84975cbaea10671bca78d90d515be713010
-
SSDEEP
98304:sPyfeoyoqRJMinHtNjYxU/1pQTaEN+jpZpSRGBQ5:sPyfxqRJZMKpa
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_3a4759965eae91a95e63c16fc044f569_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3a4759965eae91a95e63c16fc044f569_mafia.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
4.4MB