174bf7edfc61265e6563f06d6f367da8bd2c072e1e2281068b4bc3fc96fc75d6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Size

280KB
MD5

6da1d51adb63cb78a38b73af08d58364
SHA1

eeb3bd1a53eedf33f19f8821882ff0cf0af5df6c
SHA256

174bf7edfc61265e6563f06d6f367da8bd2c072e1e2281068b4bc3fc96fc75d6
SHA512

7082a25c04ff71e6e927db86a58502c9990f144bc89be705890dd3f091d4a15ff3317e4bf0a0d3dbbc1cd45020bf57f7aea9edc71f3bd8f49e9fac5ad2cd4f87
SSDEEP

6144:lQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:lQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2816	dwmsys.exe
2720	dwmsys.exe

Loads dropped DLL 3 IoCs

pid	Process
1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\DefaultIcon	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\open\command	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\ = "Application"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\open	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\dwmsys.exe\" /START \"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\DefaultIcon	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\open	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\runas	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\open\command	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\runas	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\DefaultIcon\ = "%1"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\runas\command	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\dwmsys.exe\" /START \"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\ = "systemui"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe\shell\runas\command	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.exe	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2816	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2816	1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe	28
PID 1964 wrote to memory of 2816	1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe	28
PID 1964 wrote to memory of 2816	1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe	28
PID 1964 wrote to memory of 2816	1964	2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe	28
PID 2816 wrote to memory of 2720	2816	dwmsys.exe	29
PID 2816 wrote to memory of 2720	2816	dwmsys.exe	29
PID 2816 wrote to memory of 2720	2816	dwmsys.exe	29
PID 2816 wrote to memory of 2720	2816	dwmsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-01_6da1d51adb63cb78a38b73af08d58364_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Sys32\dwmsys.exe

Filesize
280KB

MD5
94f84764b8912f5f4f67341e285bae95

SHA1
015b830ed98963430c2395185f9a5696ded34d58

SHA256
d4434cccf453cb37d01c61de7e9ce173fb3152f481743c0237600998d6adfe9b

SHA512
2920d6880a52193993e182f5a8c2ba975caf7eb3df443b5e5852797b5b79d1af4b6d8392a97968b7d884a29525e19e3c660a8b838814bc404fc4abf3375e62ec

Download Submit