69bdeb53d52c6361d9c868df9d27c9ba20b92cef6d8e923718b473acb372f6c1

General

Target

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Size

344KB
MD5

d59a7a275f0aa9101c6f92ad44da6192
SHA1

81da6f5e9e096b427f01726df5865f98cdc7479d
SHA256

69bdeb53d52c6361d9c868df9d27c9ba20b92cef6d8e923718b473acb372f6c1
SHA512

6c7cf23265ff00d9668c3ae298d17f15876e6c0c3caccf3b347b0b4306d29c170935eea7d58d2f004186fd08d64bc22c3df0398b736708789d7e88b42c2c6e44
SSDEEP

6144:qTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:qTBPFV0RyWl3h2E+7pYm0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

lsassys.exelsassys.exe

pid process

3704 lsassys.exe
980 lsassys.exe

pid	process
3704	lsassys.exe
980	lsassys.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 30 IoCs

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\DefaultIcon	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\open\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\ = "Application"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\ = "halnt"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\DefaultIcon\ = "%1"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\open\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\runas\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\DefaultIcon\ = "%1"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\open	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\runas\command	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\Content-Type = "application/x-msdownload"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\DefaultIcon	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\open	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\runas	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\Content-Type = "application/x-msdownload"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\halnt\shell\runas	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\lsassys.exe\" /START \"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lsassys.exe

description pid process

Token: SeIncBasePriorityPrivilege 3704 lsassys.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3704	lsassys.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exelsassys.exe

description	pid	process	target process
PID 868 wrote to memory of 3704	868	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	lsassys.exe
PID 868 wrote to memory of 3704	868	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	lsassys.exe
PID 868 wrote to memory of 3704	868	2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe	lsassys.exe
PID 3704 wrote to memory of 980	3704	lsassys.exe	lsassys.exe
PID 3704 wrote to memory of 980	3704	lsassys.exe	lsassys.exe
PID 3704 wrote to memory of 980	3704	lsassys.exe	lsassys.exe

C:\Users\Admin\AppData\Local\Temp\2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2022-11-23_d59a7a275f0aa9101c6f92ad44da6192_mafia_nionspy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe"
3⤵
- Executes dropped EXE
PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
9c3b595e74fb8ab528b8f5c463b2ea6b

SHA1
07a27c100f6e419444c8afde626146e57d4d3ffe

SHA256
d095328fc56cf3933e41edf2e9ad25fa4e67ee132f874f6a4da8dc15d96e91ae

SHA512
f7fa59eedb8130bd372dac6a8d56ad0a5edbd83dc5585320f69313a828c16fa6c5e0aa2bf8fba21bdf6d96dfa77dce75edec5b4fc47b2a04ab894ec903b31fe5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
9c3b595e74fb8ab528b8f5c463b2ea6b

SHA1
07a27c100f6e419444c8afde626146e57d4d3ffe

SHA256
d095328fc56cf3933e41edf2e9ad25fa4e67ee132f874f6a4da8dc15d96e91ae

SHA512
f7fa59eedb8130bd372dac6a8d56ad0a5edbd83dc5585320f69313a828c16fa6c5e0aa2bf8fba21bdf6d96dfa77dce75edec5b4fc47b2a04ab894ec903b31fe5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\lsassys.exe

Filesize
344KB

MD5
9c3b595e74fb8ab528b8f5c463b2ea6b

SHA1
07a27c100f6e419444c8afde626146e57d4d3ffe

SHA256
d095328fc56cf3933e41edf2e9ad25fa4e67ee132f874f6a4da8dc15d96e91ae

SHA512
f7fa59eedb8130bd372dac6a8d56ad0a5edbd83dc5585320f69313a828c16fa6c5e0aa2bf8fba21bdf6d96dfa77dce75edec5b4fc47b2a04ab894ec903b31fe5

Download Submit
memory/980-135-0x0000000000000000-mapping.dmp

Download
memory/3704-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads