Analysis

  • max time kernel
    139s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2023, 15:10

General

  • Target

    8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe

  • Size

    288KB

  • MD5

    8a758cf25875654dbc2eeb685a2e1675

  • SHA1

    81710391052ae965af0e31a305f70c05331a83fa

  • SHA256

    78e4d4826fa0fdeb338709105bc41fb523770ca75c59455038a67be8df259201

  • SHA512

    adafb7e906c6893747658d509db4e0992eab28aac4101da720d5244afa2a8e895858fe01626f295a158f4c532cbcbd5261649cff6fb7aa5d02330f085a05c737

  • SSDEEP

    6144:0Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:0QMyfmNFHfnWfhLZVHmOog

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"
        3⤵
        • Executes dropped EXE
        PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe

    Filesize

    288KB

    MD5

    dc19f06a2b18cfc2021e62e35b452d16

    SHA1

    d0ef5c647353454f12fd1123073cb3706c233d73

    SHA256

    cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f

    SHA512

    66918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804

  • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe

    Filesize

    288KB

    MD5

    dc19f06a2b18cfc2021e62e35b452d16

    SHA1

    d0ef5c647353454f12fd1123073cb3706c233d73

    SHA256

    cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f

    SHA512

    66918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804

  • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe

    Filesize

    288KB

    MD5

    dc19f06a2b18cfc2021e62e35b452d16

    SHA1

    d0ef5c647353454f12fd1123073cb3706c233d73

    SHA256

    cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f

    SHA512

    66918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804

  • C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe

    Filesize

    288KB

    MD5

    dc19f06a2b18cfc2021e62e35b452d16

    SHA1

    d0ef5c647353454f12fd1123073cb3706c233d73

    SHA256

    cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f

    SHA512

    66918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804