Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20-06-2024 19:07
General
-
Target
2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe
-
Size
3.4MB
-
MD5
9142e9dd7d03b14658299f311c8fa90a
-
SHA1
e5ca58f8bfc1fbf6a61eba7ea529a4ac399b3f0f
-
SHA256
4e65c1447b4c6323b75ee34da729b72c347c5d478f45e559c9a518d89cf38a19
-
SHA512
7114da6af6b3eaaf3b54e528128360ebc4fef137a5e6ef0d3396395ad26af5ff4786e97157269050133729e7927338282ed2e5c7aed6f89e651af8ad7892398c
-
SSDEEP
98304:uXWa4C+4so1VH/4DjDxH81vBN07O7EZN1oprg:uXWD4so1ku5g
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_9142e9dd7d03b14658299f311c8fa90a_mafia.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
4.0MB
-
Filesize
2.1MB
-
Filesize
4.0MB