Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe
-
Size
1.0MB
-
MD5
9765c509ec4cba3dfc7ce8b14070a5a2
-
SHA1
e05a5a702e8c284a1fd4a3fe66737673ace99f6c
-
SHA256
452fdb30be7f54022d7498ac7074a536c53d17c0d9e7efca6985ba6cf7558d0c
-
SHA512
e60f6ccd3e74ac98b1dae179b327d12278f89dbe746e70807a0e31bb915f4e37afff8fc0feb77689e3c2d06188671010bd074de400838b12c69fee3e03b349cc
-
SSDEEP
24576:taXNJQVJvxC3ZgobLzB/3gQvExFpdhC55AKDqsc53vT7PmRa:/JvCZn7B/gkUrMvLqscV7z
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/1152-3-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-27-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-29-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-28-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-30-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-31-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-34-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-36-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX behavioral1/memory/1152-40-0x00000000750E0000-0x00000000752BC000-memory.dmp UPX -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe -
resource yara_rule behavioral1/memory/1152-3-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-27-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-29-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-28-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-30-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-31-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-34-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-36-0x00000000750E0000-0x00000000752BC000-memory.dmp upx behavioral1/memory/1152-40-0x00000000750E0000-0x00000000752BC000-memory.dmp upx -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1152 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1152 2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_9765c509ec4cba3dfc7ce8b14070a5a2_mafia.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152