9ccac4133d2967b9e3781d78e30026f8f034ad90d7e8ffff6f17eb148b5ab9e3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 04:24

Target

2024-07-07_2cd4992322d79b043bb9ecc81a76ab5f_mafia.exe
Size

4.2MB
MD5

2cd4992322d79b043bb9ecc81a76ab5f
SHA1

230f37d6f66ae3cedbfb5106a3e7906b5665567c
SHA256

9ccac4133d2967b9e3781d78e30026f8f034ad90d7e8ffff6f17eb148b5ab9e3
SHA512

0cadcfdd46519daf8c99d4b9a5173b4d8ce1ecec5c61b241cd14ab8d66d8ebdfe3c51ea049daabf364c02a0d6ee06e239ba0a823df71ddaed0b5ad718840ea7e
SSDEEP

49152:94h4hErHmfBV5LOjCqhHMtDwjiMz8KK5TAg2muyiyk8cRhFO8vt:KSarmhLOjfVvjbUR2Wiyk5hF3vt

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	2024-07-07_2cd4992322d79b043bb9ecc81a76ab5f_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-07_2cd4992322d79b043bb9ecc81a76ab5f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-07_2cd4992322d79b043bb9ecc81a76ab5f_mafia.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2780

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact