Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
06/08/2023, 15:10
General
-
Target
8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe
-
Size
288KB
-
MD5
8a758cf25875654dbc2eeb685a2e1675
-
SHA1
81710391052ae965af0e31a305f70c05331a83fa
-
SHA256
78e4d4826fa0fdeb338709105bc41fb523770ca75c59455038a67be8df259201
-
SHA512
adafb7e906c6893747658d509db4e0992eab28aac4101da720d5244afa2a8e895858fe01626f295a158f4c532cbcbd5261649cff6fb7aa5d02330f085a05c737
-
SSDEEP
6144:0Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:0QMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804