Analysis
-
max time kernel
138s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
02/09/2023, 18:44
General
-
Target
2023-08-22_60423b7325169535934487c2fbccfe31_mafia_nionspy_JC.exe
-
Size
288KB
-
MD5
60423b7325169535934487c2fbccfe31
-
SHA1
b566a7657c670e1f6cec489f342ddb76945a29ac
-
SHA256
50f99d9eee6abf022c0dce5337ed8821713967833ef70e9fa543d93d15a3c42a
-
SHA512
44910cddeaee447ae081fcc2a9b34b80447dab5f623f561fd5efe4b954a4b8cbf99c14839e364ef85d94bc3df858c64f3d62a570034294855660b443088f2929
-
SSDEEP
6144:nQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:nQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_60423b7325169535934487c2fbccfe31_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_60423b7325169535934487c2fbccfe31_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\taskhostsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\taskhostsys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\taskhostsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\taskhostsys.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD596ab52e12c6f0d123208be672886c976
SHA10964fe9386aeecb77c7e30e8a5de24381f40edc5
SHA25678b1fb572176a6398a1ba19d42c32bd5c09f26a5b326e20425c57be1a4893af4
SHA5121f1db0c8ec57235f31fd6825383daec6ddba39882ff4f069eee5ebef8e36c450b6bbf81a24f627066340c92bdaf20fa76de1d5e2d95c682e3d56d239ad9987c7
-
Filesize
288KB
MD596ab52e12c6f0d123208be672886c976
SHA10964fe9386aeecb77c7e30e8a5de24381f40edc5
SHA25678b1fb572176a6398a1ba19d42c32bd5c09f26a5b326e20425c57be1a4893af4
SHA5121f1db0c8ec57235f31fd6825383daec6ddba39882ff4f069eee5ebef8e36c450b6bbf81a24f627066340c92bdaf20fa76de1d5e2d95c682e3d56d239ad9987c7
-
Filesize
288KB
MD596ab52e12c6f0d123208be672886c976
SHA10964fe9386aeecb77c7e30e8a5de24381f40edc5
SHA25678b1fb572176a6398a1ba19d42c32bd5c09f26a5b326e20425c57be1a4893af4
SHA5121f1db0c8ec57235f31fd6825383daec6ddba39882ff4f069eee5ebef8e36c450b6bbf81a24f627066340c92bdaf20fa76de1d5e2d95c682e3d56d239ad9987c7
-
Filesize
288KB
MD596ab52e12c6f0d123208be672886c976
SHA10964fe9386aeecb77c7e30e8a5de24381f40edc5
SHA25678b1fb572176a6398a1ba19d42c32bd5c09f26a5b326e20425c57be1a4893af4
SHA5121f1db0c8ec57235f31fd6825383daec6ddba39882ff4f069eee5ebef8e36c450b6bbf81a24f627066340c92bdaf20fa76de1d5e2d95c682e3d56d239ad9987c7