4fa9aed3ed51e63919eebf16c07ceb3f6e66e51e356ee3e7d880640b8c8782ca

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/09/2023, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Size

327KB
MD5

0d655e5eeb4242b1b82c9f41e8359308
SHA1

a231671390775a1560281c3885a8a55b6ea106cd
SHA256

4fa9aed3ed51e63919eebf16c07ceb3f6e66e51e356ee3e7d880640b8c8782ca
SHA512

fea3d9bf66d0d44235cd42d9cfcac50518f985b5e9263233e298d2c16e2c68059432c64cc900cde7891cc16a48053e3373599ec9f879d2acb7f9a0686fb82603
SSDEEP

6144:R2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:R2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2740	lsassys.exe
2980	lsassys.exe

Loads dropped DLL 3 IoCs

pid	Process
2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\runas\command	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\runas\command	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\runas	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\runas\command\ = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\ = "halnt"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\open	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\ = "Application"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\Content-Type = "application/x-msdownload"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\runas	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\DefaultIcon	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\lsassys.exe\" /START \"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\DefaultIcon\ = "%1"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\open\command	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\open	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\DefaultIcon	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.exe\shell\open\command	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2740	lsassys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2740	2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe	28
PID 2188 wrote to memory of 2740	2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe	28
PID 2188 wrote to memory of 2740	2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe	28
PID 2188 wrote to memory of 2740	2188	2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe	28
PID 2740 wrote to memory of 2980	2740	lsassys.exe	29
PID 2740 wrote to memory of 2980	2740	lsassys.exe	29
PID 2740 wrote to memory of 2980	2740	lsassys.exe	29
PID 2740 wrote to memory of 2980	2740	lsassys.exe	29

C:\Users\Admin\AppData\Local\Temp\2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-23_0d655e5eeb4242b1b82c9f41e8359308_mafia_nionspy_JC.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe"
    3⤵
    - Executes dropped EXE
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\XMMC\lsassys.exe

Filesize
327KB

MD5
50376a73cd5752eb284c35a67e423584

SHA1
c73203e7896229d2cf3a5b1fe5e859347ed1b76b

SHA256
e2e084596bce41a28a0af4cbfd550dac8b8af1eacb1fe443b8b9b678e40cc634

SHA512
1e8a581fc10004cc13f8f9ba76804c9449c4369dd74f2dfb5009dc00cc70cacb77c14b6cfb8297da862ae0b37764ad8dbf5ac3503e4847e7de002d5c7c49c0ff

Download Submit