8306fa07a4c5e7232efde7463104613598716b79ad9069dbd773529312580ff1

General

Target

2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Size

1.0MB
MD5

8be74c1a196229b4006e948c4c9d00a7
SHA1

10558503ef7570cfbfadafae95cc2dded9c6b86a
SHA256

8306fa07a4c5e7232efde7463104613598716b79ad9069dbd773529312580ff1
SHA512

fca3384ddc74b7bf5e22ab26b3cc66033c61cb666cbf2daa7144e0045722df26f7f70fc5a98a7b5c70c6a43357b05bed8babb7c1d23ae94e3911c4b17a96f55e
SSDEEP

24576:6aXNJQVJvxC3ZqobLzB/3gQvExFpdhC55AKDqsc53vTD/5Dm:OJvCZt7B/gkUrMvLqscVD/k

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/memory/2684-3-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-44-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-45-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-46-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-48-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-51-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX
behavioral1/memory/2684-52-0x0000000074D40000-0x0000000074F1C000-memory.dmp	UPX

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2684-3-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-44-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-45-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-46-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-48-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-51-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx
behavioral1/memory/2684-52-0x0000000074D40000-0x0000000074F1C000-memory.dmp	upx

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2684	2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-27_8be74c1a196229b4006e948c4c9d00a7_mafia.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
memory/2684-3-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-4-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2684-44-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-45-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-46-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-48-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-51-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download
memory/2684-52-0x0000000074D40000-0x0000000074F1C000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads