Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15/06/2024, 11:35
General
-
Target
2024-06-15_fec07485307d66707462e27e933b022b_mafia.exe
-
Size
1015KB
-
MD5
fec07485307d66707462e27e933b022b
-
SHA1
4c939776ab380b9ab5fb591876fefe1ae152a8dd
-
SHA256
4b32128cb41c32b40bc21d0b3ea20b432ac508fec3419333998442da2fd2ba22
-
SHA512
e95cca41f5ef09eec1c73ed3e6ebc9000fdb7c15b29c2705d513cc345f73c56c848537c9bae0fbae6661fdd3f76ab0a40f6fe1673d12fd262c8e440c126ebdf8
-
SSDEEP
24576:0aXNJQVJvxC3ZeobLzB/3gQvExFpdhC55AKDqsc53vTiixSc:EJvCZx7B/gkUrMvLqscVhxv
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 10 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_fec07485307d66707462e27e933b022b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_fec07485307d66707462e27e933b022b_mafia.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
651KB
MD5a3bc82ec91d572027540f7a796dd95fc
SHA1f843bac69c6e1b623a4b7810e691834bd4017810
SHA256cdf24004acda832634a2ca7c656672a5e9de0a6bdf753bd7bee76e87a24f8c07
SHA512262fe7617daaa2b253e93e3cb80973de4789c76c7247fa8eb0880a6ee6a92c6e3d2e54bf973d38b6943d2277f7875e8327c27e0a6361a80efa74ba84b422c8eb
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB