15bd4821fd932c2140a733a9f4698907d679e52e8b69a0aa26d0d86743543d8f

Analysis

max time kernel
123s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Size

280KB
MD5

92a2c2eef2524ec98cc7809d5f492482
SHA1

3d4c53e24dac796b1e1c86c294f8f037bb760f0e
SHA256

15bd4821fd932c2140a733a9f4698907d679e52e8b69a0aa26d0d86743543d8f
SHA512

68713c57c0f943cfca9b6142a3ef0c833501290f9cb4a5ba20654cc33277d630597b2f3557080c7aa3c5e2bfd02107a42bb1e6c807b36a0dd4986d874de0eb7f
SSDEEP

6144:GTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:GTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2980	dwmsys.exe
2736	dwmsys.exe

Loads dropped DLL 4 IoCs

pid	Process
2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
2980	dwmsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\open	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\ = "Application"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\DefaultIcon	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\runas\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\ = "systemui"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\open\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\runas	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\DefaultIcon	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\open	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\open\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\dwmsys.exe\" /START \"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\runas\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\runas	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\DefaultIcon\ = "%1"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\dwmsys.exe\" /START \"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.exe\DefaultIcon\ = "%1"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2980	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2980	2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	28
PID 2248 wrote to memory of 2980	2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	28
PID 2248 wrote to memory of 2980	2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	28
PID 2248 wrote to memory of 2980	2248	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	28
PID 2980 wrote to memory of 2736	2980	dwmsys.exe	29
PID 2980 wrote to memory of 2736	2980	dwmsys.exe	29
PID 2980 wrote to memory of 2736	2980	dwmsys.exe	29
PID 2980 wrote to memory of 2736	2980	dwmsys.exe	29

C:\Users\Admin\AppData\Local\Temp\92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
4612e5576a029186c5dd5afca1bd7847

SHA1
02797ddcd7c2b655db7cdcb3fc8242f036ebe08f

SHA256
a8286bb3ec6f6d27b04bbfd94b6c78293ade583e27f5b3cfbcc5bde001a87ba3

SHA512
d90f1cbee9258f6ea289436a61b0c1689591cf18c01c35b902992b5205405661d925209e86ea280e12afa29e121b7cf436c737d85072a9a09393e3116aedb5ad

Download Submit