15bd4821fd932c2140a733a9f4698907d679e52e8b69a0aa26d0d86743543d8f

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2023 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Size

280KB
MD5

92a2c2eef2524ec98cc7809d5f492482
SHA1

3d4c53e24dac796b1e1c86c294f8f037bb760f0e
SHA256

15bd4821fd932c2140a733a9f4698907d679e52e8b69a0aa26d0d86743543d8f
SHA512

68713c57c0f943cfca9b6142a3ef0c833501290f9cb4a5ba20654cc33277d630597b2f3557080c7aa3c5e2bfd02107a42bb1e6c807b36a0dd4986d874de0eb7f
SSDEEP

6144:GTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:GTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4700	wlogon32.exe
4780	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\DefaultIcon\ = "%1"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\runas	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\ = "haldriver"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\DefaultIcon	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\DefaultIcon	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\wlogon32.exe\" /START \"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\Content-Type = "application/x-msdownload"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\DefaultIcon\ = "%1"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\open\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\runas\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\runas\command\ = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\wlogon32.exe\" /START \"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\Content-Type = "application/x-msdownload"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\shell\open	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.exe\shell\runas\command	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\haldriver\ = "Application"	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4700	wlogon32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4700	744	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	81
PID 744 wrote to memory of 4700	744	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	81
PID 744 wrote to memory of 4700	744	92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe	81
PID 4700 wrote to memory of 4780	4700	wlogon32.exe	82
PID 4700 wrote to memory of 4780	4700	wlogon32.exe	82
PID 4700 wrote to memory of 4780	4700	wlogon32.exe	82

C:\Users\Admin\AppData\Local\Temp\92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\92a2c2eef2524ec98cc7809d5f492482_mafia_nionspy_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe

Filesize
280KB

MD5
7c9c9794e2a3ab440fb67f4d21bef0f0

SHA1
97f3303921da19dfbf2b3fd4fb6ef618ef8b60bf

SHA256
51f8cee9d4680359ef55f1fffeb0c29e8ea6b98276225270f9eedf6cacb39002

SHA512
c374463d4907694f3fcacc62fd989fa2710a8b3098f1d8b41e61d55d10db5a2a054f676fc162ddf54e69fc544064445659badc282990cfaccf3c2284fa82cf48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe

Filesize
280KB

MD5
7c9c9794e2a3ab440fb67f4d21bef0f0

SHA1
97f3303921da19dfbf2b3fd4fb6ef618ef8b60bf

SHA256
51f8cee9d4680359ef55f1fffeb0c29e8ea6b98276225270f9eedf6cacb39002

SHA512
c374463d4907694f3fcacc62fd989fa2710a8b3098f1d8b41e61d55d10db5a2a054f676fc162ddf54e69fc544064445659badc282990cfaccf3c2284fa82cf48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe

Filesize
280KB

MD5
7c9c9794e2a3ab440fb67f4d21bef0f0

SHA1
97f3303921da19dfbf2b3fd4fb6ef618ef8b60bf

SHA256
51f8cee9d4680359ef55f1fffeb0c29e8ea6b98276225270f9eedf6cacb39002

SHA512
c374463d4907694f3fcacc62fd989fa2710a8b3098f1d8b41e61d55d10db5a2a054f676fc162ddf54e69fc544064445659badc282990cfaccf3c2284fa82cf48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe

Filesize
280KB

MD5
7c9c9794e2a3ab440fb67f4d21bef0f0

SHA1
97f3303921da19dfbf2b3fd4fb6ef618ef8b60bf

SHA256
51f8cee9d4680359ef55f1fffeb0c29e8ea6b98276225270f9eedf6cacb39002

SHA512
c374463d4907694f3fcacc62fd989fa2710a8b3098f1d8b41e61d55d10db5a2a054f676fc162ddf54e69fc544064445659badc282990cfaccf3c2284fa82cf48

Download Submit