Analysis
- max time kernel
0s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/06/2024, 15:02
General
- Target 2024-06-05_a3f87d74088b855b35421cc71e1a8753_mafia.exe
- Size 508KB
- Sample240605-seflzaac7v
- SHA256 35b6647fb15ee4fb2ebfcf049f3718130099a1a73cd924f33fc224b046bbc210
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_a3f87d74088b855b35421cc71e1a8753_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_a3f87d74088b855b35421cc71e1a8753_mafia.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\n6948\s6948.exe"C:\Users\Admin\AppData\Local\Temp\n6948\s6948.exe" ins.exe /e 5916625 /u 50d1d9d5-cf90-407c-820a-35e05bc06f2f /v "C:\Users\Admin\AppData\Local\Temp\2024-06-05_a3f87d74088b855b35421cc71e1a8753_mafia.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 44762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3652 -ip 36521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
s6948.exe
memory/2468-11-0x00007FFFD9215000-0x00007FFFD9216000-memory.dmp
memory/2468-12-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-14-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-13-0x0000000001580000-0x000000000158A000-memory.dmp
memory/2468-18-0x000000001C770000-0x000000001C80C000-memory.dmp
memory/2468-17-0x000000001C200000-0x000000001C6CE000-memory.dmp
memory/2468-19-0x0000000001560000-0x0000000001568000-memory.dmp
memory/2468-20-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-21-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-22-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-23-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-24-0x000000001DAE0000-0x000000001DB42000-memory.dmp
memory/2468-25-0x00000000201D0000-0x000000002030C000-memory.dmp
memory/2468-26-0x0000000020820000-0x0000000020D2E000-memory.dmp
memory/2468-27-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp
memory/2468-29-0x00007FFFD8F60000-0x00007FFFD9901000-memory.dmp