3f94bd096f175ea6d8d41ae653399fecd9e4bd84f62206ce1389255d55cc0e0d

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 10:30

Target

2024-06-27_4863390cc38dda6cf3626a9a068db02f_mafia.exe
Size

2.7MB
MD5

4863390cc38dda6cf3626a9a068db02f
SHA1

e2756c407b3a8aedc5363a917d5420c19676776e
SHA256

3f94bd096f175ea6d8d41ae653399fecd9e4bd84f62206ce1389255d55cc0e0d
SHA512

e483cc48324ea99fc515fe5217889f849c09789c1a60318f8364174e68b44ac0e701488d19fd7744dbd8af20007029e3961e15b1d0096da1ed59315bf5c437d4
SSDEEP

49152:ssjn1sK+JcjRLO6+Yj/gaK4s4NAHmSpRSE/l83y:ssjn1s7JcpO6+Yj/HNjqRSM

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

pid	Process
2236	2024-06-27_4863390cc38dda6cf3626a9a068db02f_mafia.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	2024-06-27_4863390cc38dda6cf3626a9a068db02f_mafia.exe
2236	2024-06-27_4863390cc38dda6cf3626a9a068db02f_mafia.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\del.dll

Filesize
1.0MB

MD5
418cea23d419b469d2391f7608b372ab

SHA1
0096d9cf8ec7ca8888cfee3d82c3a19bb531a0bd

SHA256
a53a368c55b7fe0ca301ed2e657342c8365832a80708ea5a742dfbc15a9dcf82

SHA512
3b325bdbc413487cf21a2f09ae6c0a6092dc719ed6447833ffafea07a468d49b8075f6ae0c6e0508d4697d4c83fe7d804a34f1c019efb619f3f5902a2510370a

Download Submit
memory/2236-5-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download