Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16/06/2024, 02:43
General
-
Target
2024-06-16_175211f416378ca7d8c6a6a916b438dd_mafia.exe
-
Size
1.1MB
-
MD5
175211f416378ca7d8c6a6a916b438dd
-
SHA1
7f99503467077e832d4fe0350cacd358439fe791
-
SHA256
02ec8cff4005fd488010c4ad96c9b4e8dcdaf7b0b4d020faabde4c34f42dc56a
-
SHA512
5507ef31fe8946e0e9f8b99e7173c50f5b5bac139e18433057dc3a7f8fac2610ab2e8248d0c88ed91b6063fc225f85030a65b46506815c7c215b48b5c0c3330c
-
SSDEEP
24576:DKoBPMgHVnkYVsZD2etobLzB/3gQvExFpdhC55AKDqsc53vTkO/Cy+0H:Dj/HVnaZ+7B/gkUrMvLqscVF/Cy9
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 10 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_175211f416378ca7d8c6a6a916b438dd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_175211f416378ca7d8c6a6a916b438dd_mafia.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB