a8206adbaab94415db7a14283cd510b3dc67679781d4d838eba8b3d6fe7514ff

Analysis

max time kernel
126s
max time network
124s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Size

344KB
MD5

8e261b67fcd36b84bbf35112caa67f24
SHA1

223bf3d5dea2774c944194d8f85579ded09c57b0
SHA256

a8206adbaab94415db7a14283cd510b3dc67679781d4d838eba8b3d6fe7514ff
SHA512

85b881d242598f7c57e5acb0839771fc9fac29e75ce536a001a130f4dd403b7eed375b6b822a456cfbe09c8425f6d89fa09486423411b89820ba5f3d5da9490c
SSDEEP

6144:tTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:tTBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2532	csrssys.exe
2148	csrssys.exe

Loads dropped DLL 4 IoCs

pid	Process
868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
2532	csrssys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\ = "wexplorer"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\DefaultIcon\ = "%1"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\DefaultIcon\ = "%1"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\ = "Application"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\DefaultIcon	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*"	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\DefaultIcon	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2532	csrssys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2532	868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe	30
PID 868 wrote to memory of 2532	868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe	30
PID 868 wrote to memory of 2532	868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe	30
PID 868 wrote to memory of 2532	868	8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe	30
PID 2532 wrote to memory of 2148	2532	csrssys.exe	31
PID 2532 wrote to memory of 2148	2532	csrssys.exe	31
PID 2532 wrote to memory of 2148	2532	csrssys.exe	31
PID 2532 wrote to memory of 2148	2532	csrssys.exe	31

C:\Users\Admin\AppData\Local\Temp\8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"
    3⤵
    - Executes dropped EXE
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe

Filesize
344KB

MD5
7c96ff234219e359660d2ba8da89bb00

SHA1
24a56a9220b1d83a9654369145a8d99c14cffd11

SHA256
768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502

SHA512
854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0

Download Submit