Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe
-
Size
288KB
-
MD5
8a758cf25875654dbc2eeb685a2e1675
-
SHA1
81710391052ae965af0e31a305f70c05331a83fa
-
SHA256
78e4d4826fa0fdeb338709105bc41fb523770ca75c59455038a67be8df259201
-
SHA512
adafb7e906c6893747658d509db4e0992eab28aac4101da720d5244afa2a8e895858fe01626f295a158f4c532cbcbd5261649cff6fb7aa5d02330f085a05c737
-
SSDEEP
6144:0Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:0QMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4064 lsassys.exe 2036 lsassys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\open\command 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\runas 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\DefaultIcon 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\DefaultIcon\ = "%1" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\Content-Type = "application/x-msdownload" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\DefaultIcon 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\lsassys.exe\" /START \"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\ = "Application" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\runas\command 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\open 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\open 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\runas 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\DefaultIcon\ = "%1" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\lsassys.exe\" /START \"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\ = "halnt" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\open\command 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\runas\command 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\.exe\Content-Type = "application/x-msdownload" 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4064 lsassys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4064 5032 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe 82 PID 5032 wrote to memory of 4064 5032 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe 82 PID 5032 wrote to memory of 4064 5032 8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe 82 PID 4064 wrote to memory of 2036 4064 lsassys.exe 83 PID 4064 wrote to memory of 2036 4064 lsassys.exe 83 PID 4064 wrote to memory of 2036 4064 lsassys.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\8a758cf25875654dbc2eeb685a2e1675_mafia_nionspy_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\lsassys.exe"3⤵
- Executes dropped EXE
PID:2036
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804
-
Filesize
288KB
MD5dc19f06a2b18cfc2021e62e35b452d16
SHA1d0ef5c647353454f12fd1123073cb3706c233d73
SHA256cef43045068953306229d71f5c2bc6ed141ff9a25cae1fb16914e80f6ba6161f
SHA51266918d15eab45d908fcaeeb37e0830789a3d742ccfe4957c0644b6f14dde7d27ee983d4855a7f5d858c247063ab80b7da2624f2816b9557706f621053efd4804