Overview

overview

7

Static

static

3

2024-02-04...py.exe

windows7-x64

7

2024-02-04...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-02-04_9db761b8da4c4dbd08cb8ee4aa80a199_mafia_nionspy.exe

  • Size

    328KB

  • MD5

    9db761b8da4c4dbd08cb8ee4aa80a199

  • SHA1

    d898b58bf7b606c1c508eeadee83db047f051129

  • SHA256

    9363fc7a67fd6de266c0638fa9d12f0fe591983b70a3375899bf8562dfcdc024

  • SHA512

    3970f24c0512b9fd39d7573b87bdc3a18945b2439cd68bd4f58cacaab9bc7bead584f8a18c1a3b764c1f8a7192cdec901871c7a1e832d6e4b50ea1535b2af432

  • SSDEEP

    6144:z2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:z2TFafJiHCWBWPMjVWrXf1v

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-04_9db761b8da4c4dbd08cb8ee4aa80a199_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-04_9db761b8da4c4dbd08cb8ee4aa80a199_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe"
        3⤵
        • Executes dropped EXE
        PID:1256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\taskhostsys.exe
    Filesize

    328KB

    MD5

    dd8a9b4dba72094e80f4da42fd3ed61e

    SHA1

    1405a3a30f9917418c5c7262a508842a3a1d6b22

    SHA256

    b1d6e8a06d55f824860debf0c03ef4fbc0faf062a7cfd11fd3f7f910b8b1af33

    SHA512

    6ed093b201df548989b256cfa59d500203ff5df5b1b181462edc72b7c1f71c5bcbcdbd3271d79a8ca2b120010771d8e18e3a5bdee26114e0c4d2581cb77c67d2

    Download Submit