8245e3d8d30eddda1f300c21daf6d51819d75009bc7041107a2132d458fc1072

Analysis

max time kernel
122s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Size

327KB
MD5

113a4229cb6f745ca4b968078a8ea2a1
SHA1

eb2909925bf4048b8992285a83b7abc497e89d01
SHA256

8245e3d8d30eddda1f300c21daf6d51819d75009bc7041107a2132d458fc1072
SHA512

def17b5ce0f5f12a81160c74d1587448c514681299e5231d23dbb9d9b158152561d52bd16ad55630c7e72802a9810aae925a9ed5194f37fb0fa2bc5768349513
SSDEEP

6144:R2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:R2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2804	taskhostsys.exe
2660	taskhostsys.exe

Loads dropped DLL 4 IoCs

pid	Process
2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
2804	taskhostsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\runas	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\open	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\runas\command	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon\ = "%1"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\ = "Application"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\DefaultIcon\ = "%1"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\DefaultIcon	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\jitc\shell\open\command	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\ = "jitc"	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2804	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2804	2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe	28
PID 2092 wrote to memory of 2804	2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe	28
PID 2092 wrote to memory of 2804	2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe	28
PID 2092 wrote to memory of 2804	2092	113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe	28
PID 2804 wrote to memory of 2660	2804	taskhostsys.exe	29
PID 2804 wrote to memory of 2660	2804	taskhostsys.exe	29
PID 2804 wrote to memory of 2660	2804	taskhostsys.exe	29
PID 2804 wrote to memory of 2660	2804	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\113a4229cb6f745ca4b968078a8ea2a1_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe

Filesize
327KB

MD5
a38b12b97959f67bfcfb6b9ec97245d0

SHA1
ccd94c6b672918449403208c2a9d5ade4402772e

SHA256
76ab5187633dcf95504d4bbc2ceb39cf21f8b6ffb3ef1ca0c235f570b81f49f5

SHA512
ca7ce6c42b5d4e4fa9040106c830dedc84fdd125443349796f050d8167f3a3167bd0e606c0e7b9c8e29ae2d42501527b438bb40798aa6539a1b90f95296de6aa

Download Submit