4fbafa669f22736fddd7e176a20ae4c4595239ef08c70551f5d6dfb7eb2d23b6

Analysis

max time kernel
121s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Size

280KB
MD5

94e4b63296a4fae37377f0006ae9a09c
SHA1

49eefbdf18440cdfc92e60e687d3826708bcf706
SHA256

4fbafa669f22736fddd7e176a20ae4c4595239ef08c70551f5d6dfb7eb2d23b6
SHA512

a82215a2c1c5c06fdf7ffc66be7bfbd75d2c167eb1809cc2c4ee52630bb1e2415d143f61d6780873e76bb707ebc2131982e67940cac19faefbeb6d525231a5e0
SSDEEP

6144:XTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:XTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1696	dwmsys.exe
2364	dwmsys.exe

Loads dropped DLL 4 IoCs

pid	Process
1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
1696	dwmsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\dwmsys.exe\" /START \"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\DefaultIcon	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\runas	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\ = "Application"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\DefaultIcon\ = "%1"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\open	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\open\command	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\ = "systemui"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\dwmsys.exe\" /START \"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\systemui\shell\runas\command	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1696	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1696	1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe	28
PID 1972 wrote to memory of 1696	1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe	28
PID 1972 wrote to memory of 1696	1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe	28
PID 1972 wrote to memory of 1696	1972	2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe	28
PID 1696 wrote to memory of 2364	1696	dwmsys.exe	29
PID 1696 wrote to memory of 2364	1696	dwmsys.exe	29
PID 1696 wrote to memory of 2364	1696	dwmsys.exe	29
PID 1696 wrote to memory of 2364	1696	dwmsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_94e4b63296a4fae37377f0006ae9a09c_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe

Filesize
280KB

MD5
e50dd8a790f92afdb6cf6ed7bd455dd7

SHA1
12edbbc65b3fc00524a5ff560db9c66050098819

SHA256
5373aa7046513b96f1d71129ac3e1f0bac6dff7263a648347eac30951a922b91

SHA512
46a8f9adfb6e3e4952a8799aea8c28c233d1107def5641b69f9572a108947c33af319207104c4bc93cac5966f8306b7f06cd79881e75c3a1cae1838d940cd451

Download Submit