8b6bfc846cfed814cc4c8f5e6e0626a239f3e83dabd5618cd8795276f9d2c6a2

Analysis

max time kernel
123s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Size

280KB
MD5

2c4464cdd5a7cf6be11cf396d6e87909
SHA1

be3e63b6b8f14dc849e7f4a0cc1fcbb53f8554d9
SHA256

8b6bfc846cfed814cc4c8f5e6e0626a239f3e83dabd5618cd8795276f9d2c6a2
SHA512

7cfb2621be5d5df9dd21f4b38f12ae26e7bc86a0c18f61132cfd49d1828f58be0f762f58b79face8c8017790208a09d3ba3ad529193ead9c412c9827bf151eca
SSDEEP

6144:IQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:IQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1252	SearchIndexerDB.exe
2812	SearchIndexerDB.exe

Loads dropped DLL 3 IoCs

pid	Process
2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\ = "cmos"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\DefaultIcon	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\DefaultIcon\ = "%1"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\ = "Application"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1252	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1252	2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe	28
PID 2340 wrote to memory of 1252	2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe	28
PID 2340 wrote to memory of 1252	2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe	28
PID 2340 wrote to memory of 1252	2340	2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe	28
PID 1252 wrote to memory of 2812	1252	SearchIndexerDB.exe	29
PID 1252 wrote to memory of 2812	1252	SearchIndexerDB.exe	29
PID 1252 wrote to memory of 2812	1252	SearchIndexerDB.exe	29
PID 1252 wrote to memory of 2812	1252	SearchIndexerDB.exe	29

C:\Users\Admin\AppData\Local\Temp\2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2c4464cdd5a7cf6be11cf396d6e87909_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe

Filesize
280KB

MD5
263693c99fe7284f6277b6ac9faa6019

SHA1
c540353c431d11d29a051a1bf4a893862f89f329

SHA256
d9847a9bc30a4eb9bd66dce767349f61b2428c3372400a9289a551fe4257b49a

SHA512
16e4f3f35b6d659080f3d983eb95d601ff4b8faaaa3daa09bee149747895df9559aa94b4b1b4af5232a1e05ff8d2a2c034074d3f8029d3a3cea26791c9d48dfc

Download Submit