76e1cc15f9690c188b01bcf6aaa8efc26074dbbe234ebc1ecbd3cd859a52a0c7

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Size

327KB
MD5

ad80e06eb653195c9200caaf0e8a23dc
SHA1

3ccb6eeb927e6e195ff7c66642d208c84604c62b
SHA256

76e1cc15f9690c188b01bcf6aaa8efc26074dbbe234ebc1ecbd3cd859a52a0c7
SHA512

0ec2f081e7819fb80c27c8e80564bb4c80bdb327324a7c296b817e22ea035627328adb4a2a6eaf2bd53a07a274b669a67117c6575903a8d2f22c0998423687a7
SSDEEP

6144:92+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:92TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1120	csrssys.exe
3696	csrssys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\open\command	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\Content-Type = "application/x-msdownload"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\runas\command	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\runas\command\ = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\csrssys.exe\" /START \"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\DefaultIcon	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\DefaultIcon\ = "%1"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon\ = "%1"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\open	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\runas	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\ = "Application"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\ = "wexplorer"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\Content-Type = "application/x-msdownload"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\csrssys.exe\" /START \"%1\" %*"	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1120	csrssys.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1120	2904	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe	84
PID 2904 wrote to memory of 1120	2904	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe	84
PID 2904 wrote to memory of 1120	2904	ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe	84
PID 1120 wrote to memory of 3696	1120	csrssys.exe	85
PID 1120 wrote to memory of 3696	1120	csrssys.exe	85
PID 1120 wrote to memory of 3696	1120	csrssys.exe	85

C:\Users\Admin\AppData\Local\Temp\ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ad80e06eb653195c9200caaf0e8a23dc_mafia_nionspy_JC.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe"
    3⤵
    - Executes dropped EXE
    PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe

Filesize
327KB

MD5
b933dedafd831dc4f37d8da4be4b2c65

SHA1
7ce0153d96023db11f10d6f7a19f723e49467c00

SHA256
de5bfa9ab2564d8cebc49ce0d0929d89afa59e68747180a5b49a4cbbf314de2a

SHA512
0d6510f99bf9042df7c718419171b036d6828a6f18c64229e2e7f0741de9036cbeff90675f27f40fc7992cffdf250f0e023e14d47dba636858327fb66cdfc911

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe

Filesize
327KB

MD5
b933dedafd831dc4f37d8da4be4b2c65

SHA1
7ce0153d96023db11f10d6f7a19f723e49467c00

SHA256
de5bfa9ab2564d8cebc49ce0d0929d89afa59e68747180a5b49a4cbbf314de2a

SHA512
0d6510f99bf9042df7c718419171b036d6828a6f18c64229e2e7f0741de9036cbeff90675f27f40fc7992cffdf250f0e023e14d47dba636858327fb66cdfc911

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe

Filesize
327KB

MD5
b933dedafd831dc4f37d8da4be4b2c65

SHA1
7ce0153d96023db11f10d6f7a19f723e49467c00

SHA256
de5bfa9ab2564d8cebc49ce0d0929d89afa59e68747180a5b49a4cbbf314de2a

SHA512
0d6510f99bf9042df7c718419171b036d6828a6f18c64229e2e7f0741de9036cbeff90675f27f40fc7992cffdf250f0e023e14d47dba636858327fb66cdfc911

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SView\csrssys.exe

Filesize
327KB

MD5
b933dedafd831dc4f37d8da4be4b2c65

SHA1
7ce0153d96023db11f10d6f7a19f723e49467c00

SHA256
de5bfa9ab2564d8cebc49ce0d0929d89afa59e68747180a5b49a4cbbf314de2a

SHA512
0d6510f99bf9042df7c718419171b036d6828a6f18c64229e2e7f0741de9036cbeff90675f27f40fc7992cffdf250f0e023e14d47dba636858327fb66cdfc911

Download Submit