Overview

overview

7

Static

static

1

2024-10-13...ia.exe

windows7-x64

7

2024-10-13...ia.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 16:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe

  • Size

    5.2MB

  • MD5

    3f4a03f8a8175dca67144e9f8e8f9a09

  • SHA1

    c2f3d8e50c856c75e0027c275a29006138a0bbf3

  • SHA256

    1622723148a6fc7841e649373a24767d65c839fc67939a805d81ae77af51e6ff

  • SHA512

    4a6a1da0324ce619cc3e7cbe784d67c91f632f1c7614f2922128e88608683a53c54aa02ca25e02cafda471e68bdf5b9db15dcd3e01cae399f60e1258aa0059f5

  • SSDEEP

    49152:APAuXLwfvsmmbPHOY7QDpHPCnFVAl0G0MNUUNrGUTNJsbq/ybpm/k:C8sBbPH4HPCFVAlP0ArGaN9wpm/

Score
7/10
discoveryupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\Download_93F3\2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe
      "C:\Users\Admin\AppData\Local\Temp\Download_93F3\2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe" --elevated
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1080
        3⤵
        • Program crash
        PID:1648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1440
      2⤵
      • Program crash
      PID:3332
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4716 -ip 4716
    1⤵
      PID:4584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4452 -ip 4452
      1⤵
        PID:3120

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\Download_93F3\2024-10-13_3f4a03f8a8175dca67144e9f8e8f9a09_mafia.exe
              Filesize

              5.2MB

              MD5

              3f4a03f8a8175dca67144e9f8e8f9a09

              SHA1

              c2f3d8e50c856c75e0027c275a29006138a0bbf3

              SHA256

              1622723148a6fc7841e649373a24767d65c839fc67939a805d81ae77af51e6ff

              SHA512

              4a6a1da0324ce619cc3e7cbe784d67c91f632f1c7614f2922128e88608683a53c54aa02ca25e02cafda471e68bdf5b9db15dcd3e01cae399f60e1258aa0059f5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\htmlayout.dll
              Filesize

              925KB

              MD5

              7222f8144a764f45b21fbc89e007c4c9

              SHA1

              0d77d686698d24a13b9678cb61a4af42ea5917d0

              SHA256

              c3460cb07883a9593c6aa889242bfff169f6a754f3e288768be93894bd5f7f62

              SHA512

              a4b294fa6e5ece0d3ed60c50d88d787c192c6ba07df222f50feb09d34450556840b4ff4e24a2dc52602029fed0e0e88143e84db474d995050e274af40527e192

              Download Submit

            • memory/4452-19-0x0000000010000000-0x0000000010261000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/4452-22-0x0000000010000000-0x0000000010261000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/4716-6-0x0000000010000000-0x0000000010261000-memory.dmp

              Filesize

              2.4MB

              Download

            • memory/4716-21-0x0000000010000000-0x0000000010261000-memory.dmp

              Filesize

              2.4MB

              Download