2b2c0dcb7e13c395323c8735fd71061a8a9071559aeb33d82b176642058df766

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:05

Target

2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Size

7.8MB
MD5

2a458f6b385c48aad46da18e8ac9c0ac
SHA1

412ee0f36a8376626f299146ef90c9b27d66f82e
SHA256

2b2c0dcb7e13c395323c8735fd71061a8a9071559aeb33d82b176642058df766
SHA512

0b7dfd6112ad23890333e2a18445091eeefa30a8526e82cde2fa8c330d5e73582a8e34de2a24ba8f924a7d8d4dea1589203174238a31b2a991fa7cb203d5c1fa
SSDEEP

196608:sTMnqr0rCcQVfXEBVL712AVDBRk3tao+A47IcMRVeWY:sTMnqreFQ9q9712AVDBRk3taoG0zeWY

Score

1^/10

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\DefaultIcon	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\shell	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\shell\ = "open"	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PokerStars.exe\" -url %1"	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\URL Protocol	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PokerStars.exe\",1"	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\shell\open	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\shell\open\command	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\auxclient\ = "URL:PokerStars Protocol"	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe
4292	2024-06-01_2a458f6b385c48aad46da18e8ac9c0ac_mafia.exe