Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
31/05/2024, 19:59
General
-
Target
2024-05-31_ffa4af7adf27bb1ccdbe20c49cfe2b92_mafia.exe
-
Size
8.4MB
-
MD5
ffa4af7adf27bb1ccdbe20c49cfe2b92
-
SHA1
dffeaacc38c70d59b263095a38bbe0770c83ba56
-
SHA256
b1577a1a83f863db137f4e23b04c25a99e440646151035ecacbac6c95481629c
-
SHA512
dd4b5fe64fd3b095c0e117d539f671be82b18dc6a2b033da62f572e2dd0536e0954ab99509a62e13e46c5e930aba4ba207f7f33ca311db671b43ed24455d1121
-
SSDEEP
196608:nc0FPSFS3hbFWiI2R7yj04cBzbu+K955:ncUakxZxRd80tK955
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_ffa4af7adf27bb1ccdbe20c49cfe2b92_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_ffa4af7adf27bb1ccdbe20c49cfe2b92_mafia.exe"1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
689B
MD55c89a37149e36ba57237288a4bc3984e
SHA1f2c899f44304be949ea08be1b54724c6d3c05e01
SHA256128e36cf7b65fef2e313b0f4b6a5cc2de4113a3e39a6d849d47f0da59521f8c0
SHA51293e45319447a47d1f14687d7d9b4f6dd6ec4394010841c497581533368d2ce31b4c874594d80a4d916f081d667aa1f400a52c1a1371f6e864484d4bdfdb32eff
-
Filesize
1KB
MD555a0ebb918a2059989f1db6d3e2229a0
SHA1d350e0aa185518c64e9e8b4874791579edb097be
SHA256713cbb132ecb762d65d016f392a237ab96e438b39974c98db6ce922a8017c4ad
SHA512479c652659a3e2b31cf744a64ee872020a3d5f0bb74a09113a523d51c8fedf03968b4b45b66a2b32d4bc7b9f9772fdd75880e1a7eed23e2913e6623060b16be9
-
Filesize
4KB
MD5f2aaebc46c5b16aa457715c7e948c7b1
SHA1f6a149b9610b2914502886bea861636d90fb0e6a
SHA256c4c03794b025adef56f6cec3577011e9d124472745b3ab79f523559ecc9cc9ec
SHA51290408d7509bc530e387a1d622bbad3469f68da4713c73cb719054a9f71803eb796c06694fe105a9e63e487c051ac204551cc5c63eff30780530e93300fcb630b
-
Filesize
547B
MD52696fb85b8e93ffd2a52267706e8d549
SHA1074400951274d397797ee4d7e9b94f928ec2d214
SHA256b1571285ac60c35dd3cd358bf64f0c823db1e0946a68dd8d8160ab0e9ca8e249
SHA5123d58edec75e6758c2eecbbd11a19a5b47261a0d4d011682ee7f91c86a5fcbd2f24580a5a44051161a9564684f93973911d225dda50caf1ba77aa1d9ab129ba4e
-
Filesize
1KB
MD5c22261d7e105777f025b7b281756ef89
SHA15ea19788f84ba7c00697f8196f38944ff16fa8ae
SHA256002d673873dc44ed47bcb4d9c2094357007e19d630906f4aadcad689234e800d
SHA512e54c78b11d85294c1077ae16b43cc2cda9bc2df616509c695810fa070593b8663322c46c6f7722ca6be17ceffa1711eb8bbd43e2e45817e9cfdf41946d535050
-
Filesize
1KB
MD5b6a1f85e34ce02771f66a6ef22df172a
SHA13a363b62698bb713307203db18d60c611a4ccde9
SHA256a4eed9dc5cfb9b19ae1840b1bb322838a4dd9e7a02eee2252c94aa1d1174de9a
SHA5126e81cee199d1ae452f0c59a278d3af86339c6aa9d4d0d94023f6f8ccd9faea7966a889916fed69d3128a207cbc2793a1d379be748f98b3c46611175b6a6ca250
-
Filesize
1KB
MD5610cf60759f05b367d3c7f4eb18cd666
SHA1b7900838c7c5171552e031cd8a4c3322c08c8c63
SHA2565219d729bdb01f46378ada7842d32a2319b5916005bcb4f90e3ee043133c89bb
SHA51249ebe3c365b42a28b24741ed96f1049d234606a9f80c2f879f0aa11091766867bd8561d12707a2741f1fbbfec1ec7ca801ddde3240f37e83743ec7d25254ee0e
-
Filesize
1KB
MD5a4bae34b325551fd10f4b0f88afbfb91
SHA10b0eec693ed4450ba8d4cd0e7c5f7f84ff7ccc12
SHA2561be0f3cfde426934e996e44c0e6c1d9a5d033a0357caad2e907622a73c8a7d56
SHA5125122a82662d33d223924652e9d2ca1dfbfb30352969bf1a160f1576ebb2eca38e4ae524e1c0aa0f8276d4bc96275af01f3811ec9d184f13a855f4077d3c0c2e1