52951d622b8e4a9313f6e156d6551eacee77dec75a11ea4ab2e33d59c44e08aa

Analysis

max time kernel
137s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Size

344KB
MD5

90fb96afa20c0a1fba49b0623b675638
SHA1

5dc23e4cdf8a7d530a6c7b4c0b150f501f33641a
SHA256

52951d622b8e4a9313f6e156d6551eacee77dec75a11ea4ab2e33d59c44e08aa
SHA512

7934b2d1cae7df79e187651e8cc55bb6fd4341220a60a2b2bb611c24851d6e5dcef0e09dcd8b911c8fe043c78b7f615e4203c53ccc04077c18f3e58241828429
SSDEEP

6144:cTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:cTBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4264	lsassys.exe
4076	lsassys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\ = "Application"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\open	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\runas\command	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\DefaultIcon	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\runas	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\DefaultIcon\ = "%1"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\DefaultIcon\ = "%1"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\open\command	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\Local Settings	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell\runas	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\Content-Type = "application/x-msdownload"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\ = "halnt"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\DefaultIcon	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\open\command	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\open	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt\shell\runas\command	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\Content-Type = "application/x-msdownload"	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\halnt	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000_Classes\.exe\shell	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4264	lsassys.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4264	5100	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe	87
PID 5100 wrote to memory of 4264	5100	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe	87
PID 5100 wrote to memory of 4264	5100	90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe	87
PID 4264 wrote to memory of 4076	4264	lsassys.exe	88
PID 4264 wrote to memory of 4076	4264	lsassys.exe	88
PID 4264 wrote to memory of 4076	4264	lsassys.exe	88

C:\Users\Admin\AppData\Local\Temp\90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\90fb96afa20c0a1fba49b0623b675638_mafia_nionspy_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"
    3⤵
    - Executes dropped EXE
    PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
344KB

MD5
bfaf25bf1ba72ed5cda2db9de5b5869b

SHA1
7f2fa7774c67999f7020738b949d4b48a0430bf9

SHA256
ae6120b34f2db8897e393199529b72c3e470cae8638a455340b4fdc606897ec1

SHA512
3bcb44181c0fe21bb6b1dc5a7b9776f413f93639af392b81997ddd78d6d5ee0cc17762bd9a8613e6669a6236294319d0441fd0f2bf640a99c67874760f613f2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
344KB

MD5
bfaf25bf1ba72ed5cda2db9de5b5869b

SHA1
7f2fa7774c67999f7020738b949d4b48a0430bf9

SHA256
ae6120b34f2db8897e393199529b72c3e470cae8638a455340b4fdc606897ec1

SHA512
3bcb44181c0fe21bb6b1dc5a7b9776f413f93639af392b81997ddd78d6d5ee0cc17762bd9a8613e6669a6236294319d0441fd0f2bf640a99c67874760f613f2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
344KB

MD5
bfaf25bf1ba72ed5cda2db9de5b5869b

SHA1
7f2fa7774c67999f7020738b949d4b48a0430bf9

SHA256
ae6120b34f2db8897e393199529b72c3e470cae8638a455340b4fdc606897ec1

SHA512
3bcb44181c0fe21bb6b1dc5a7b9776f413f93639af392b81997ddd78d6d5ee0cc17762bd9a8613e6669a6236294319d0441fd0f2bf640a99c67874760f613f2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe

Filesize
344KB

MD5
bfaf25bf1ba72ed5cda2db9de5b5869b

SHA1
7f2fa7774c67999f7020738b949d4b48a0430bf9

SHA256
ae6120b34f2db8897e393199529b72c3e470cae8638a455340b4fdc606897ec1

SHA512
3bcb44181c0fe21bb6b1dc5a7b9776f413f93639af392b81997ddd78d6d5ee0cc17762bd9a8613e6669a6236294319d0441fd0f2bf640a99c67874760f613f2a

Download Submit