ab2490f1a5e7fd34e355aad2b2b8da4eb3c7bc786df8e84ef15c207bfde03f46

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Size

327KB
MD5

ab20c922a8a0e323f5c7b91af378183c
SHA1

3621ddf0f79b7d5f772fdbf930b19a40d6f7baad
SHA256

ab2490f1a5e7fd34e355aad2b2b8da4eb3c7bc786df8e84ef15c207bfde03f46
SHA512

bde2d464b34d3d3f950ab8bedd09ae37bc4e876cadc243b1247295ac40d86b67ca764322aa2b50d11531f3f2cc3c462a8f88c70d66f5ccf3bd1c8801bdb58824
SSDEEP

6144:w2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:w2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
776	wlogon32.exe
2872	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\wlogon32.exe\" /START \"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\ = "haldriver"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\wlogon32.exe\" /START \"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\ = "Application"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\Content-Type = "application/x-msdownload"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\DefaultIcon\ = "%1"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\open\command	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\runas	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon\ = "%1"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\open	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\Content-Type = "application/x-msdownload"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\runas\command\ = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\runas\command	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\DefaultIcon	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	776	wlogon32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 776	4404	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe	82
PID 4404 wrote to memory of 776	4404	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe	82
PID 4404 wrote to memory of 776	4404	ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe	82
PID 776 wrote to memory of 2872	776	wlogon32.exe	83
PID 776 wrote to memory of 2872	776	wlogon32.exe	83
PID 776 wrote to memory of 2872	776	wlogon32.exe	83

C:\Users\Admin\AppData\Local\Temp\ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ab20c922a8a0e323f5c7b91af378183c_mafia_nionspy_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe

Filesize
327KB

MD5
e88e7d8281d97f1278017320bcfc2e1c

SHA1
f7b572b53b90ab0427c49b3a66c2178117096d3e

SHA256
0b9c566c108c1f2f5b20f9f68c7bfe1351e0e56db22dbff71a273950e12ee374

SHA512
474440deeee5bd11ced5bf05841ece22e23050f79a05551de02ca79257f34fcb70c7f279a8e091809a0bc53cf56e04a27d040b04dd59bb4a1b5368389e1d0c30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe

Filesize
327KB

MD5
e88e7d8281d97f1278017320bcfc2e1c

SHA1
f7b572b53b90ab0427c49b3a66c2178117096d3e

SHA256
0b9c566c108c1f2f5b20f9f68c7bfe1351e0e56db22dbff71a273950e12ee374

SHA512
474440deeee5bd11ced5bf05841ece22e23050f79a05551de02ca79257f34fcb70c7f279a8e091809a0bc53cf56e04a27d040b04dd59bb4a1b5368389e1d0c30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe

Filesize
327KB

MD5
e88e7d8281d97f1278017320bcfc2e1c

SHA1
f7b572b53b90ab0427c49b3a66c2178117096d3e

SHA256
0b9c566c108c1f2f5b20f9f68c7bfe1351e0e56db22dbff71a273950e12ee374

SHA512
474440deeee5bd11ced5bf05841ece22e23050f79a05551de02ca79257f34fcb70c7f279a8e091809a0bc53cf56e04a27d040b04dd59bb4a1b5368389e1d0c30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe

Filesize
327KB

MD5
e88e7d8281d97f1278017320bcfc2e1c

SHA1
f7b572b53b90ab0427c49b3a66c2178117096d3e

SHA256
0b9c566c108c1f2f5b20f9f68c7bfe1351e0e56db22dbff71a273950e12ee374

SHA512
474440deeee5bd11ced5bf05841ece22e23050f79a05551de02ca79257f34fcb70c7f279a8e091809a0bc53cf56e04a27d040b04dd59bb4a1b5368389e1d0c30

Download Submit