30bd0436ffb40e8e97f9739e568326d0880d511126003d7747dc355075891e40

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Size

280KB
MD5

61e36b20ca3e84645e1cdab65b3c7eb2
SHA1

cb8431fbd6eed4917739e536fda71a24649a6a79
SHA256

30bd0436ffb40e8e97f9739e568326d0880d511126003d7747dc355075891e40
SHA512

1157a38b7182e62db869a7e2973731b0cc7f894ed7a0c28738c083c98cc41932ddf52e021b83f24f9b339874029c5892f72c961e448fe150790b5fc300a80ee2
SSDEEP

6144:5iQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:kQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2896	SearchIndexerDB.exe
2848	SearchIndexerDB.exe

Loads dropped DLL 3 IoCs

pid	Process
2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\open\command	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\open	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\ = "Application"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\runas\command	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\DefaultIcon	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\runas	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\runas	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\DefaultIcon\ = "%1"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\ = "cmos"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\runas\command	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\DefaultIcon	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\open	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\open\command	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2896	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2896	2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe	28
PID 2256 wrote to memory of 2896	2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe	28
PID 2256 wrote to memory of 2896	2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe	28
PID 2256 wrote to memory of 2896	2256	2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe	28
PID 2896 wrote to memory of 2848	2896	SearchIndexerDB.exe	29
PID 2896 wrote to memory of 2848	2896	SearchIndexerDB.exe	29
PID 2896 wrote to memory of 2848	2896	SearchIndexerDB.exe	29
PID 2896 wrote to memory of 2848	2896	SearchIndexerDB.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_61e36b20ca3e84645e1cdab65b3c7eb2_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
280KB

MD5
13bc02f7afa732255cb41f81476e3529

SHA1
e35a5994805fd9532f6e802818e15d44bc33adc9

SHA256
4748824a9ec891aa768e30c93dc39f5cc7750d69756951c80e4d4d54b8bb85ae

SHA512
f38804ac841e39add83f278fe31f35747a16f53bc51e16a4214479a2ee00318be205863b7232148cf2492327dc50e98cc3648fce9e76939f65056b361fc317a0

Download Submit