Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
03/09/2023, 10:03
General
-
Target
2023-08-22_881d04f0525d0ad641598b998ac8ed17_mafia_nionspy_JC.exe
-
Size
288KB
-
MD5
881d04f0525d0ad641598b998ac8ed17
-
SHA1
f6d8f49d278972b42e3205174288415ee34e410c
-
SHA256
b0fb1cf475cd61266560fa87aeef48f54b03abb18e9e120f8c4947a64f718b5a
-
SHA512
2e110c5f13768f1bef7b0dab8ab6c92f853c820ccbf93dcc790d9999e829b7afab29b891a98fa1d8025893d46cffa79097696b49cd986a75f541626e6f1104a9
-
SSDEEP
6144:GQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:GQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_881d04f0525d0ad641598b998ac8ed17_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_881d04f0525d0ad641598b998ac8ed17_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD54919c54af5b41a9f1aff1bb47b492848
SHA16e8a2dc34d8b445ad55f21a797ef2b163d7f5930
SHA256e4b82a42b4ae423f4975fe275fe024c839e2d8554fb1d06cef0015ffc6ebd569
SHA512a20fba3e9154a4ddf812859570129f84d6cfef92ec2d2a7322b2a16d2a71d89e7dc25f6002e4660b1e41ed2019b8fe9d6e60ad427e1d32fa7128676dfe66c192
-
Filesize
288KB
MD54919c54af5b41a9f1aff1bb47b492848
SHA16e8a2dc34d8b445ad55f21a797ef2b163d7f5930
SHA256e4b82a42b4ae423f4975fe275fe024c839e2d8554fb1d06cef0015ffc6ebd569
SHA512a20fba3e9154a4ddf812859570129f84d6cfef92ec2d2a7322b2a16d2a71d89e7dc25f6002e4660b1e41ed2019b8fe9d6e60ad427e1d32fa7128676dfe66c192
-
Filesize
288KB
MD54919c54af5b41a9f1aff1bb47b492848
SHA16e8a2dc34d8b445ad55f21a797ef2b163d7f5930
SHA256e4b82a42b4ae423f4975fe275fe024c839e2d8554fb1d06cef0015ffc6ebd569
SHA512a20fba3e9154a4ddf812859570129f84d6cfef92ec2d2a7322b2a16d2a71d89e7dc25f6002e4660b1e41ed2019b8fe9d6e60ad427e1d32fa7128676dfe66c192
-
Filesize
288KB
MD54919c54af5b41a9f1aff1bb47b492848
SHA16e8a2dc34d8b445ad55f21a797ef2b163d7f5930
SHA256e4b82a42b4ae423f4975fe275fe024c839e2d8554fb1d06cef0015ffc6ebd569
SHA512a20fba3e9154a4ddf812859570129f84d6cfef92ec2d2a7322b2a16d2a71d89e7dc25f6002e4660b1e41ed2019b8fe9d6e60ad427e1d32fa7128676dfe66c192