2b973867e396978b50c171a97a2a8391301ced5cca9806eb573fad31d35e52dd

Analysis

max time kernel
121s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Size

274KB
MD5

d5798bbb18f9a4c427149c313251d6a3
SHA1

7613bd6ec998213fedd6705850d8ce6b78d12101
SHA256

2b973867e396978b50c171a97a2a8391301ced5cca9806eb573fad31d35e52dd
SHA512

c7c10ab838d2c044ea6386898aaa5ed0cc4a46c6c9301bfc43f1db2ea9be32c54b108202f2843505059fb08015dcd2e2d1711a54162480f5865f828b4dea3858
SSDEEP

6144:MYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:MYvEbrUjp3SpWggd3JBPlPDIQ3g

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2292	wlogon32.exe
2668	wlogon32.exe

Loads dropped DLL 4 IoCs

pid	Process
2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
2292	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\ = "Application"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\runas\command	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\open\command	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\runas	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\DefaultIcon	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\ = "haldriver"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\open	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2292	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2292	2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe	28
PID 2232 wrote to memory of 2292	2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe	28
PID 2232 wrote to memory of 2292	2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe	28
PID 2232 wrote to memory of 2292	2232	2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe	28
PID 2292 wrote to memory of 2668	2292	wlogon32.exe	29
PID 2292 wrote to memory of 2668	2292	wlogon32.exe	29
PID 2292 wrote to memory of 2668	2292	wlogon32.exe	29
PID 2292 wrote to memory of 2668	2292	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_d5798bbb18f9a4c427149c313251d6a3_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe

Filesize
274KB

MD5
655bb8f6263617317c8709c6ff49541f

SHA1
9262dc5dd8a9b57924cc6d563c6c3354339c565b

SHA256
48c7fa3ad5ea033eb45e99816aecf565a14fc9302e4a7600e34b302c894e8291

SHA512
7115b50f2a0de76b03bce75ce269d027e99b14a67b96cf53159d70bf24d44024410e8f8696670d155f23118175825494c758552d1455c0b4c00a6eb04c3640dd

Download Submit