General

  • Target

    2024-06-20_33227a1ed8f8706529fe121455327cc8_mafia

  • Size

    946KB

  • Sample

    240620-fhmhgavajj

  • MD5

    33227a1ed8f8706529fe121455327cc8

  • SHA1

    4722dbe085a07392f574b37b7a853f969b3eac7c

  • SHA256

    81414586f7ee05f125ec5d61bd3800ea44bc12e566c20c64d3528bf4f0f0ab71

  • SHA512

    c416d9f4f6b11b852701959d20e946d85c70e6eee97dc6f10fddf24e743a0cee2032211a5fc19312f1c32be96cf3d0519987f5cddffccf37b1dfce2554f8bf01

  • SSDEEP

    24576:39BRa0veGEVv6DtieiXf9rYkkui6unVO4:35a0GJVSD0nX1rYkWV5

Malware Config

Targets

    • Target

      2024-06-20_33227a1ed8f8706529fe121455327cc8_mafia

    • Size

      946KB

    • MD5

      33227a1ed8f8706529fe121455327cc8

    • SHA1

      4722dbe085a07392f574b37b7a853f969b3eac7c

    • SHA256

      81414586f7ee05f125ec5d61bd3800ea44bc12e566c20c64d3528bf4f0f0ab71

    • SHA512

      c416d9f4f6b11b852701959d20e946d85c70e6eee97dc6f10fddf24e743a0cee2032211a5fc19312f1c32be96cf3d0519987f5cddffccf37b1dfce2554f8bf01

    • SSDEEP

      24576:39BRa0veGEVv6DtieiXf9rYkkui6unVO4:35a0GJVSD0nX1rYkWV5

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks