6fcb00c6b7e839e0a1bb00f33f621fcd1ae70d0dfaa2421c767c35105aaa30de

Analysis

max time kernel
125s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/08/2023, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Size

327KB
MD5

58dae094aea0371bf580bf9471d016d4
SHA1

daa27c0b9f046cac532dc6b2ae613e5139f61162
SHA256

6fcb00c6b7e839e0a1bb00f33f621fcd1ae70d0dfaa2421c767c35105aaa30de
SHA512

2e708da76bd0ee3448b1fb9fcf82264d8120bfecfd815c269f32188642e558f7a49413c40eeb6e4264a5425e54e6d4d67444e8c68ee2b68681ad1b8fa60c98c8
SSDEEP

6144:I2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:I2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1264	lsassys.exe
2416	lsassys.exe

Loads dropped DLL 3 IoCs

pid	Process
2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\runas\command	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\DefaultIcon	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\open	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\DefaultIcon\ = "%1"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\ = "Application"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\DefaultIcon	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\runas\command\ = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\ = "halnt"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\Content-Type = "application/x-msdownload"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\open\command	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\shell\runas	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\halnt\DefaultIcon\ = "%1"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.exe\shell\open\command	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1264	lsassys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1264	2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe	28
PID 2560 wrote to memory of 1264	2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe	28
PID 2560 wrote to memory of 1264	2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe	28
PID 2560 wrote to memory of 1264	2560	58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe	28
PID 1264 wrote to memory of 2416	1264	lsassys.exe	29
PID 1264 wrote to memory of 2416	1264	lsassys.exe	29
PID 1264 wrote to memory of 2416	1264	lsassys.exe	29
PID 1264 wrote to memory of 2416	1264	lsassys.exe	29

C:\Users\Admin\AppData\Local\Temp\58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\58dae094aea0371bf580bf9471d016d4_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"
    3⤵
    - Executes dropped EXE
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
327KB

MD5
227d638b623d02e26c0aaa7913578a7a

SHA1
3d829931e802159f254aabbe906b5e1d590d5c9f

SHA256
d9721024dc41db95e684ff64f641fe9b18ea7d9725a2ef629e9136a714b76897

SHA512
ac7581619005c9cd166cfa1df00cf9d7bc78d3319537ea4afa25021375182f7b4cea5e3331601de2abb56f3934e2c905f576d426b97b6a1e70bc539fb0db2996

Download Submit