Analysis
-
max time kernel
93s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 01:45
General
-
Target
2024-06-28_5cf01bf6781b1556fc711a60837db804_mafia.exe
-
Size
1.0MB
-
MD5
5cf01bf6781b1556fc711a60837db804
-
SHA1
7f0fb5a8854d55803eb7cd46cb14b5d9adc38ecd
-
SHA256
d56ff8a59d4b08e4a4b1884c0970f7c576fbd2e2490eaecdb4ff1a1d93daf563
-
SHA512
7cd6b0a3eaef36e5c9e85d4b29ed3404f72d71b65744be55cc2d49be8d16c667b4855278316bf90f27fe2dbb5e1b95d772414f6ef6c25d24e9f98c6d175b59bf
-
SSDEEP
24576:BclLF5IFnEDJ7o5k+bEGx8/A3bIm6gQJgk87m0j:EBDdo5kbG+/wbIm6gQJgk87m0j
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_5cf01bf6781b1556fc711a60837db804_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_5cf01bf6781b1556fc711a60837db804_mafia.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 8762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3636 -ip 36361⤵