Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 03:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe
Resource
win7-20240508-en
General
-
Target
2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe
-
Size
2.2MB
-
MD5
933770fb3e5e9762d7cfef6781436f5c
-
SHA1
4828659dbd888b5e4ea299ae0ad404e25fd1b6e3
-
SHA256
a7b57cf2ce4a94e57569333a4deccefa91ee744490be6b87191e768b65816c4f
-
SHA512
8abf1ebbdd13b1cec324ed55c1db930dd2318cea1677e85d3f30c4d16f3ca74c9789f2da59def03c66f46fd6fd7ca12bafaa696141d8dc418b3a875c23948785
-
SSDEEP
49152:C/I3Cf9S251VfogxifwOd5gDFmiirf908vu3AjmZI5GwCz8ETGP3yFLCsabSTl0D:GIZ2LV1ifwOdeFmisf908vu3AjmZIFXX
Malware Config
Signatures
-
Detects executables built or packed with MPress PE compressor 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SFrame.exe INDICATOR_EXE_Packed_MPress -
Downloads MZ/PE file
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
Processes:
flow ioc 4 https://launcher-rappelz.play2bit.com/launcher/us/ 13 https://pixel.pentacle.kr/31?ret=html&ep=page_location%3Dhttps%3A%2F%2Flauncher-rappelz.play2bit.com%2Flauncher%2Fus%2F&ep=page_title%3DRappelz%20Launcher&en=pixel&hcb=5660378212721 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exepid process 1196 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe 1196 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe 1196 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe 1196 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe 1196 2024-06-19_933770fb3e5e9762d7cfef6781436f5c_mafia.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exeFilesize
2.2MB
MD5933770fb3e5e9762d7cfef6781436f5c
SHA14828659dbd888b5e4ea299ae0ad404e25fd1b6e3
SHA256a7b57cf2ce4a94e57569333a4deccefa91ee744490be6b87191e768b65816c4f
SHA5128abf1ebbdd13b1cec324ed55c1db930dd2318cea1677e85d3f30c4d16f3ca74c9789f2da59def03c66f46fd6fd7ca12bafaa696141d8dc418b3a875c23948785
-
C:\Users\Admin\AppData\Local\Temp\SFrame.exeFilesize
3.1MB
MD5ebeaee9777f21e81d5af2206594e6b32
SHA1cdd56155f57153d7d8fa4075986a5feac0a482a3
SHA25699db8e6a84ed50332a4e64e8b7e71b51fb75bae59e585ea10410b323754491c0
SHA5127426ad14d6c61d87a64ae959136df82340addac627ce0f6ec60ee9b2d98e8ed9ed55575850bcb3becfddbe1213e883fc6751958378a165ba6d2f43debd1123ff
-
memory/1196-35-0x0000000007250000-0x0000000007270000-memory.dmpFilesize
128KB
-
memory/1196-36-0x0000000007250000-0x0000000007270000-memory.dmpFilesize
128KB
-
memory/1196-119-0x0000000007250000-0x0000000007270000-memory.dmpFilesize
128KB