2214ef5bf65914b217c331c5cce83c54d45c0a67892c6403acbe6534c468f35b

General

Target

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Size

344KB
MD5

b51fc371ec27f293bccdb3db89a27e56
SHA1

8912c0e45d16b9a5b1550bda8a56c8ab88ba6adf
SHA256

2214ef5bf65914b217c331c5cce83c54d45c0a67892c6403acbe6534c468f35b
SHA512

dc3bfdcd557e129f0e5e149007c43bf85528ee7d708c896447a4a2e0f4395df2d79429535660ce57e5adc8fb9c9af54f62fefc08028afde72bbc42e5b7777e5d
SSDEEP

6144:RTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:RTBPFV0RyWl3h2E+7pYm0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

lsassys.exelsassys.exe

pid process

1448 lsassys.exe
1132 lsassys.exe

pid	process
1448	lsassys.exe
1132	lsassys.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 30 IoCs

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\DefaultIcon	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\ = "halnt"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\Content-Type = "application/x-msdownload"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\runas\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\ = "Application"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\DefaultIcon\ = "%1"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\open\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\open\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\runas	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\runas	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\DefaultIcon\ = "%1"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\runas\command	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\Content-Type = "application/x-msdownload"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\DefaultIcon	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\.exe\shell\open	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\open	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lsassys.exe

description pid process

Token: SeIncBasePriorityPrivilege 1448 lsassys.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1448	lsassys.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exelsassys.exe

description	pid	process	target process
PID 1500 wrote to memory of 1448	1500	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	lsassys.exe
PID 1500 wrote to memory of 1448	1500	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	lsassys.exe
PID 1500 wrote to memory of 1448	1500	2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe	lsassys.exe
PID 1448 wrote to memory of 1132	1448	lsassys.exe	lsassys.exe
PID 1448 wrote to memory of 1132	1448	lsassys.exe	lsassys.exe
PID 1448 wrote to memory of 1132	1448	lsassys.exe	lsassys.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_b51fc371ec27f293bccdb3db89a27e56_mafia_nionspy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
3⤵
- Executes dropped EXE
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
be9f76e95d02906a0929c814257949f4

SHA1
84262727b34755a06ee9eace33b07b131fa16f95

SHA256
c50d229e20fb586a4f3442e2a6060fc2a6b3bede390ae3cec2252bf96eea4373

SHA512
2bcdc2c4534b2483f681762d00e532fd9e9f1a3d4e100904c2c23ea5989656f270d8c6b748b36f498d91da144d1f07067b105f8dd0d05f6acc36a5dcd9966057

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
be9f76e95d02906a0929c814257949f4

SHA1
84262727b34755a06ee9eace33b07b131fa16f95

SHA256
c50d229e20fb586a4f3442e2a6060fc2a6b3bede390ae3cec2252bf96eea4373

SHA512
2bcdc2c4534b2483f681762d00e532fd9e9f1a3d4e100904c2c23ea5989656f270d8c6b748b36f498d91da144d1f07067b105f8dd0d05f6acc36a5dcd9966057

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
be9f76e95d02906a0929c814257949f4

SHA1
84262727b34755a06ee9eace33b07b131fa16f95

SHA256
c50d229e20fb586a4f3442e2a6060fc2a6b3bede390ae3cec2252bf96eea4373

SHA512
2bcdc2c4534b2483f681762d00e532fd9e9f1a3d4e100904c2c23ea5989656f270d8c6b748b36f498d91da144d1f07067b105f8dd0d05f6acc36a5dcd9966057

Download Submit
memory/1132-135-0x0000000000000000-mapping.dmp

Download
memory/1448-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads