93f649787722af9ba2af2f379aa1ec12f7396cb4e16edc0d0ac327ab84edcfc5 | Triage

Sharing

General

Target

2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia
Size

22.3MB
Sample

240727-bqy41szhrg
MD5

f24ab55c8821cf9064a193daa7858f59
SHA1

02cd91240c71f441666d2c831812da99ee22732f
SHA256

93f649787722af9ba2af2f379aa1ec12f7396cb4e16edc0d0ac327ab84edcfc5
SHA512

585ab87f37f25789431fb9423a10dee4253bfad5867a51175746b58ab3d3db419659bf37b7d5d9d0cd694b0cfe483a558ca4bab5660b92a9391999d019d89958
SSDEEP

393216:oi/dD5V6dOCyWG2NIgJ5pJzdCZG82nbxocDAfl4IRkrSWXf3IdMUfAZQohXafkfb:TRjKpLBJzUGRtNa4IRkrnvYdMUfY5Xas

Score

8^/10

discovery evasion execution

Malware Config

Targets

- Target
  
  2024-07-27_f24ab55c8821cf9064a193daa7858f59_mafia
- Size
  
  22.3MB
- MD5
  
  f24ab55c8821cf9064a193daa7858f59
- SHA1
  
  02cd91240c71f441666d2c831812da99ee22732f
- SHA256
  
  93f649787722af9ba2af2f379aa1ec12f7396cb4e16edc0d0ac327ab84edcfc5
- SHA512
  
  585ab87f37f25789431fb9423a10dee4253bfad5867a51175746b58ab3d3db419659bf37b7d5d9d0cd694b0cfe483a558ca4bab5660b92a9391999d019d89958
- SSDEEP
  
  393216:oi/dD5V6dOCyWG2NIgJ5pJzdCZG82nbxocDAfl4IRkrSWXf3IdMUfAZQohXafkfb:TRjKpLBJzUGRtNa4IRkrnvYdMUfY5Xas
Score

8^/10

discovery evasion execution
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecution

behavioral2

discoveryevasionexecution