2dcbda5e96deca54be624823e93cb17ea158e2dcffb95f575b686a7875856192

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/08/2023, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Size

288KB
MD5

face7bd424e80ca419b12ccd20b302ba
SHA1

44a12a3c7ee1fa8897cd6784e9cadadd94e767e0
SHA256

2dcbda5e96deca54be624823e93cb17ea158e2dcffb95f575b686a7875856192
SHA512

bba78325bf9e8021b03a5258614f5b9e33e8fde00540f19660db947df0a461c91c3d07f6fe625c86d059c78c4bf3161658172edb4ef0a1392fb19c3ddd1b9830
SSDEEP

6144:BQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:BQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2436	wlogon32.exe
2952	wlogon32.exe

Loads dropped DLL 4 IoCs

pid	Process
2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
2436	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\DefaultIcon\ = "%1"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\open	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\DefaultIcon	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\DefaultIcon	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\ = "Application"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\runas	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\runas	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\open	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\runas\command	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\open\command	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\ = "haldriver"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell\runas\command	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell\open\command	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\haldriver\shell	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\.exe\shell	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2436	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2436	2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe	28
PID 2192 wrote to memory of 2436	2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe	28
PID 2192 wrote to memory of 2436	2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe	28
PID 2192 wrote to memory of 2436	2192	face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe	28
PID 2436 wrote to memory of 2952	2436	wlogon32.exe	29
PID 2436 wrote to memory of 2952	2436	wlogon32.exe	29
PID 2436 wrote to memory of 2952	2436	wlogon32.exe	29
PID 2436 wrote to memory of 2952	2436	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\face7bd424e80ca419b12ccd20b302ba_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
288KB

MD5
cf2ed56532f589c896d3e582ddea31c0

SHA1
d231b747b6d0f8c227f0fc811a08b645a2335c65

SHA256
4e02f351c7ca45225730598e7cf61f75e7889f6c3606ab95fb4218b30e7c61eb

SHA512
04d73b226178af486f7e125222d886b2863d5c0f0f887ebc66d7de7df78631b9e3f668b9ee47aad51920de19de636f3a70a75e13cd69fe9508418bf23d32a5f4

Download Submit