Overview

overview

7

Static

static

3

2024-02-01...py.exe

windows7-x64

7

2024-02-01...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-01_3cf51a911769d803b2523e10ffc65f5a_mafia_nionspy.exe

  • Size

    288KB

  • MD5

    3cf51a911769d803b2523e10ffc65f5a

  • SHA1

    78343eb542e7745cb3c9335beccddec506d23e2f

  • SHA256

    ebf03bba82672b29cef006fbc479784aa3fef1bd6c12b21d5c33f16bdb206137

  • SHA512

    fa716d2a313f73dc915af8bd5ed5d7138c3fe6c717782568084c1931e7508673026e2535ff5d11644dee27a8e41d48882328d0c0dd3d318883df2b7df0aa826f

  • SSDEEP

    6144:JQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:JQMyfmNFHfnWfhLZVHmOog

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-01_3cf51a911769d803b2523e10ffc65f5a_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-01_3cf51a911769d803b2523e10ffc65f5a_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe"
        3⤵
        • Executes dropped EXE
        PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\dwmsys.exe
    Filesize

    288KB

    MD5

    bc90764f9ef262f0ae404ec1141f1bd0

    SHA1

    3fcaae82ccf688e4a14f6dce7ed22458d9f622cf

    SHA256

    ce7cb9aa7c74850f51f587271a2c627cfb1eaafeea8fedbb7c210e3b425cfc33

    SHA512

    08d69cbb6b6a47b3f8b03ed39ec21318334582e79b47d5d87fa08aa6f53a9b194af4f17123e5aa914b3a640d3381134eed0f5db09f51de764d17a4d9c286117f

    Download Submit