69bdeb53d52c6361d9c868df9d27c9ba20b92cef6d8e923718b473acb372f6c1

General

Target

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Size

344KB
MD5

d59a7a275f0aa9101c6f92ad44da6192
SHA1

81da6f5e9e096b427f01726df5865f98cdc7479d
SHA256

69bdeb53d52c6361d9c868df9d27c9ba20b92cef6d8e923718b473acb372f6c1
SHA512

6c7cf23265ff00d9668c3ae298d17f15876e6c0c3caccf3b347b0b4306d29c170935eea7d58d2f004186fd08d64bc22c3df0398b736708789d7e88b42c2c6e44
SSDEEP

6144:qTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:qTBPFV0RyWl3h2E+7pYm0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

csrssys.execsrssys.exe

pid process

968 csrssys.exe
888 csrssys.exe

pid	process
968	csrssys.exe
888	csrssys.exe

Loads dropped DLL 3 IoCs

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

pid	process
1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 28 IoCs

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\ = "Application"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\DefaultIcon	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\runas	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\open	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\ = "wexplorer"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\runas\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\DefaultIcon\ = "%1"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\open\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\DefaultIcon	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

csrssys.exe

description pid process

Token: SeIncBasePriorityPrivilege 968 csrssys.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	968	csrssys.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.execsrssys.exe

description	pid	process	target process
PID 1504 wrote to memory of 968	1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	csrssys.exe
PID 1504 wrote to memory of 968	1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	csrssys.exe
PID 1504 wrote to memory of 968	1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	csrssys.exe
PID 1504 wrote to memory of 968	1504	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	csrssys.exe
PID 968 wrote to memory of 888	968	csrssys.exe	csrssys.exe
PID 968 wrote to memory of 888	968	csrssys.exe	csrssys.exe
PID 968 wrote to memory of 888	968	csrssys.exe	csrssys.exe
PID 968 wrote to memory of 888	968	csrssys.exe	csrssys.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"
3⤵
- Executes dropped EXE
PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
8b2cef03293fb3cbde883fe804e2bb53

SHA1
c525cd990eec8c53b708110a3f4fe685858a6eba

SHA256
ed5a27fdf1c05b000e1daec353794d61a77738d6d2f42999a09b77c9dcb4c989

SHA512
e51044f54f62690a878368b4e01f2a8df034bd51373bed763ea6e4a2810685bf4a3aabc8514ae3a5f3c62089b550331341801285d4031846f29d5b059a65e5ec

Download Submit
memory/888-62-0x0000000000000000-mapping.dmp

Download
memory/968-58-0x0000000000000000-mapping.dmp

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads