bbc6ee50a6080c97bcf2d4a1eb38f59951804ee65070f0091a57ba28dab45ddc

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/08/2023, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Size

327KB
MD5

1cebacbec9ac4220dbf893a93ad97ff2
SHA1

832594e7ffafba46e1d40bc005024bab9c072a19
SHA256

bbc6ee50a6080c97bcf2d4a1eb38f59951804ee65070f0091a57ba28dab45ddc
SHA512

bcb5ca7cf521141487a729445100e9da58744382b8db741c574df86eec8f90791e362911d237fae2c5e4be066efdd86337294615e09cb3ddd236b7ce5296e437
SSDEEP

6144:V2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:V2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2824	winit32.exe
2928	winit32.exe

Loads dropped DLL 3 IoCs

pid	Process
2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\ = "ntdriver"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\ = "Application"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\DefaultIcon	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\open\command	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\DefaultIcon\ = "%1"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\open	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\runas	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\ntdriver\shell\runas\command	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon\ = "%1"	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2824	winit32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2824	2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe	28
PID 2152 wrote to memory of 2824	2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe	28
PID 2152 wrote to memory of 2824	2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe	28
PID 2152 wrote to memory of 2824	2152	1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe	28
PID 2824 wrote to memory of 2928	2824	winit32.exe	29
PID 2824 wrote to memory of 2928	2824	winit32.exe	29
PID 2824 wrote to memory of 2928	2824	winit32.exe	29
PID 2824 wrote to memory of 2928	2824	winit32.exe	29

C:\Users\Admin\AppData\Local\Temp\1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1cebacbec9ac4220dbf893a93ad97ff2_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
327KB

MD5
bb247ddbba9172f7dff4d2614459b633

SHA1
864df32f676830a34933b314a5ab6f3dd20a52f7

SHA256
5d31cc697c78f3ebb510503c4d018c770be1757e0dd24a32e57db8eb05502946

SHA512
97682a5ee89db2b803f08d068bf2993745610c80eee7e363641246e448bed450951ba0fa95c0e92d9240fffe4b6d28ce51126157801e06850013a628920759f1

Download Submit