Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
16/06/2024, 09:45
General
-
Target
2024-06-16_5a20c0a6001736583e32b05ed6cb601a_mafia.exe
-
Size
1015KB
-
MD5
5a20c0a6001736583e32b05ed6cb601a
-
SHA1
2542f9c9e0f4980dba5f2b8c21f41eb88be91b24
-
SHA256
f73e6dc616b4a2ea71bf8c80506995ef5aae97515456791e60dc77e648d765c7
-
SHA512
814dc37a93c1e14497b2e515ede31f3e3439550db0a48bb75cd9054928f9fd78d047532a5053b9509949c8a317ca0fc93e97a56410da4cf49929e8e154130694
-
SSDEEP
24576:jaXNJQVJvxC3ZtobLzB/3gQvExFpdhC55AKDqsc53vTkO/YF:hJvCZa7B/gkUrMvLqscVF/U
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 10 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_5a20c0a6001736583e32b05ed6cb601a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_5a20c0a6001736583e32b05ed6cb601a_mafia.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB