de51a7afc114096fbddd485ff00e552045900b12fee018702aa33960a741e046

Analysis

max time kernel
122s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Size

344KB
MD5

1487f35b21b9abaf0b15e89bc3762799
SHA1

0dddf05cc92d1381bdc17ff138bffb23458bfb03
SHA256

de51a7afc114096fbddd485ff00e552045900b12fee018702aa33960a741e046
SHA512

c79aa86f8c9b4ad2f23265a2e7961e2d04705fccf3a15a0ebfd764ce474d8b0d1b46c863f3e8894269407df40536e35224b03f26f27e0da2d356a33ebd0288ba
SSDEEP

6144:NTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:NTBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2928	sidebar2.exe
2604	sidebar2.exe

Loads dropped DLL 4 IoCs

pid	Process
2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
2928	sidebar2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\DefaultIcon	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\open\command	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\sidebar2.exe\" /START \"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\DefaultIcon	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\DefaultIcon\ = "%1"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\open	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\runas\command\ = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\ = "prochost"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\runas\command	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\Content-Type = "application/x-msdownload"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\runas\command	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\runas	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.exe\shell\runas	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\ = "Application"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\open\command	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\sidebar2.exe\" /START \"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\open	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2928	sidebar2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2928	2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2928	2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2928	2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2928	2920	2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe	28
PID 2928 wrote to memory of 2604	2928	sidebar2.exe	29
PID 2928 wrote to memory of 2604	2928	sidebar2.exe	29
PID 2928 wrote to memory of 2604	2928	sidebar2.exe	29
PID 2928 wrote to memory of 2604	2928	sidebar2.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_1487f35b21b9abaf0b15e89bc3762799_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe"
    3⤵
    - Executes dropped EXE
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe

Filesize
344KB

MD5
6822a79fabe42d41cbc2540c35e95b80

SHA1
3831fc69adea273ff32a20b2d862fea96913e2e3

SHA256
d1ee31052820d9b318b57b8347181cfaa09679a96f443c17b1c7543d784f893a

SHA512
edfb0d823ba944b81d9995c24e8b867231ec423db2ac2a25196b6b2fe6a791adbc96f52f7b0251ff2cc7b8c3602f091100ccfbfa575caa28c6584540633090a3

Download Submit