Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
07/06/2024, 01:34
General
-
Target
2024-06-07_c509fa36dd7c1f0e9064a6d98032d94a_mafia.exe
-
Size
1.0MB
-
MD5
c509fa36dd7c1f0e9064a6d98032d94a
-
SHA1
7546c2cfe292030a2cd44a35443f9d5e265b647d
-
SHA256
dcae89982b2e8f1e96969047948a98f5d2e453aa34eb99f7d9ed3f53f6b58cc8
-
SHA512
5706c05943a9037f01a46b5c2d3e1409127f4dc5ee52b2688406066874cc42ea5f0ec4cb3ada43426e95efe271f88435f5c4bb266b48483e98d2cc324c63fb69
-
SSDEEP
24576:SaXNJQVJvxC3ZAobLzB/3gQvExFpdhC55AKDqsc53vT7PmbF:WJvCZH7B/gkUrMvLqscV7S
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 9 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_c509fa36dd7c1f0e9064a6d98032d94a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_c509fa36dd7c1f0e9064a6d98032d94a_mafia.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB