Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
29-06-2024 01:36
General
-
Target
2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe
-
Size
3.6MB
-
MD5
9b7a7273b86b36290b3aeed5f3e5592e
-
SHA1
065a1876ba99879eda8d777a7469a305d6fbee53
-
SHA256
c2102aa0acb0116b4501663081e45a8bb57d73747aa9843f5efa119e9f79736a
-
SHA512
5cd19b63037d835dd6b8a53329f8a980bbbb7169aad10ffdd0ae1ba24a0bad7e7690b113f2553d3582062f7fd0a47439c68211ba9e7163fa9c62d27c15abed96
-
SSDEEP
49152:tvzUbobNPjTxUvXqPke8ke5oY6cQU5rsG6pAQ7kATRAjmztGKy+ljvTsy+qFvaw6:tvZPkeZe5oY6cQU5rsG66QVAq5zHCJN
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
4.4MB