72c616887a9d1943fc0be9c498aba8493f9544e74a1e77485a98e609b950ec96

Analysis

max time kernel
139s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:28

Target

2024-06-28_6daeac01f4ea81c8d1d786394bf7e971_mafia.exe
Size

2.7MB
MD5

6daeac01f4ea81c8d1d786394bf7e971
SHA1

ca2035d2fadadbbb1a8abdd3573476892243a080
SHA256

72c616887a9d1943fc0be9c498aba8493f9544e74a1e77485a98e609b950ec96
SHA512

b414d2b1ef4f62ca6f866fbe1f9f4c51ba23f3f283a9e2933f799de4b47b38546c70fd5edd7b3afccbf0ad98813877c0b146b7c33f7317378370930d9a5cd255
SSDEEP

49152:6sjn1sK+JcjRLO6+Yj/gaK4sGNAHmSpRSE/l83G:6sjn1s7JcpO6+Yj/1NjqRS4

Score

7^/10

discovery

Loads dropped DLL 1 IoCs

pid	Process
4404	2024-06-28_6daeac01f4ea81c8d1d786394bf7e971_mafia.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	2024-06-28_6daeac01f4ea81c8d1d786394bf7e971_mafia.exe
4404	2024-06-28_6daeac01f4ea81c8d1d786394bf7e971_mafia.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\del.dll

Filesize
1.0MB

MD5
418cea23d419b469d2391f7608b372ab

SHA1
0096d9cf8ec7ca8888cfee3d82c3a19bb531a0bd

SHA256
a53a368c55b7fe0ca301ed2e657342c8365832a80708ea5a742dfbc15a9dcf82

SHA512
3b325bdbc413487cf21a2f09ae6c0a6092dc719ed6447833ffafea07a468d49b8075f6ae0c6e0508d4697d4c83fe7d804a34f1c019efb619f3f5902a2510370a

Download Submit
memory/4404-6-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download