2214ef5bf65914b217c331c5cce83c54d45c0a67892c6403acbe6534c468f35b

General

Target

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Size

344KB
MD5

b51fc371ec27f293bccdb3db89a27e56
SHA1

8912c0e45d16b9a5b1550bda8a56c8ab88ba6adf
SHA256

2214ef5bf65914b217c331c5cce83c54d45c0a67892c6403acbe6534c468f35b
SHA512

dc3bfdcd557e129f0e5e149007c43bf85528ee7d708c896447a4a2e0f4395df2d79429535660ce57e5adc8fb9c9af54f62fefc08028afde72bbc42e5b7777e5d
SSDEEP

6144:RTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:RTBPFV0RyWl3h2E+7pYm0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

taskhostsys.exetaskhostsys.exe

pid process

880 taskhostsys.exe
1784 taskhostsys.exe

pid	process
880	taskhostsys.exe
1784	taskhostsys.exe

Loads dropped DLL 3 IoCs

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

pid	process
288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 28 IoCs

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\ = "Application"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\runas	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\DefaultIcon	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\DefaultIcon	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\DefaultIcon\ = "%1"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\open	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\open\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\runas\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\ = "jitc"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskhostsys.exe

description pid process

Token: SeIncBasePriorityPrivilege 880 taskhostsys.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	880	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exetaskhostsys.exe

description	pid	process	target process
PID 288 wrote to memory of 880	288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	taskhostsys.exe
PID 288 wrote to memory of 880	288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	taskhostsys.exe
PID 288 wrote to memory of 880	288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	taskhostsys.exe
PID 288 wrote to memory of 880	288	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	taskhostsys.exe
PID 880 wrote to memory of 1784	880	taskhostsys.exe	taskhostsys.exe
PID 880 wrote to memory of 1784	880	taskhostsys.exe	taskhostsys.exe
PID 880 wrote to memory of 1784	880	taskhostsys.exe	taskhostsys.exe
PID 880 wrote to memory of 1784	880	taskhostsys.exe	taskhostsys.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"
3⤵
- Executes dropped EXE
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
344KB

MD5
b71d20105bab8e7246723d41f9923ee5

SHA1
6e31fbf811d20481043d2b9721479aa0190bd4fa

SHA256
968929a98580f3f2b7f369214cfb090a0d901fff58ae5a925b54f057ad196102

SHA512
6eed74f27adf9d85a78a5c82cff9dd094a96486ecf6e0b1f42e5d0bbd31351488da6f647d6ef4ecd0a7780830452dc2b1ca943df235236f0926d5d27f2441f36

Download Submit
memory/288-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/880-58-0x0000000000000000-mapping.dmp

Download
memory/1784-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads