Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
29-06-2024 01:36
General
-
Target
2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe
-
Size
3.6MB
-
MD5
9b7a7273b86b36290b3aeed5f3e5592e
-
SHA1
065a1876ba99879eda8d777a7469a305d6fbee53
-
SHA256
c2102aa0acb0116b4501663081e45a8bb57d73747aa9843f5efa119e9f79736a
-
SHA512
5cd19b63037d835dd6b8a53329f8a980bbbb7169aad10ffdd0ae1ba24a0bad7e7690b113f2553d3582062f7fd0a47439c68211ba9e7163fa9c62d27c15abed96
-
SSDEEP
49152:tvzUbobNPjTxUvXqPke8ke5oY6cQU5rsG6pAQ7kATRAjmztGKy+ljvTsy+qFvaw6:tvZPkeZe5oY6cQU5rsG66QVAq5zHCJN
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_9b7a7273b86b36290b3aeed5f3e5592e_mafia.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
2.0MB
-
Filesize
4.4MB