0621ef22885777df9c78aab03cf0e5359dbf5bafa8792aea834207a231fdffb3

Analysis

max time kernel
123s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Size

280KB
MD5

a6ef4f2df17738c9716de45599d1c1e1
SHA1

3c6c21f8f7e5d83ed33d2432e0be4cbc55e7a48c
SHA256

0621ef22885777df9c78aab03cf0e5359dbf5bafa8792aea834207a231fdffb3
SHA512

92d0ed47c4661c6de555175ec016725d5747e5e8c5845dbf4631af320f536fc1464f097a6cde41e60b106e1a6f0b48eb20205ec80dd8fe50bcef2617c51b6a14
SSDEEP

6144:6Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:6QMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2704	taskhostsys.exe
2608	taskhostsys.exe

Loads dropped DLL 3 IoCs

pid	Process
2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\open\command	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\DefaultIcon	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\runas\command	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\runas	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\ = "jitc"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\ = "Application"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\DefaultIcon\ = "%1"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\open	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\DefaultIcon	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2704	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2704	2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2704	2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2704	2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2704	2020	2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe	28
PID 2704 wrote to memory of 2608	2704	taskhostsys.exe	29
PID 2704 wrote to memory of 2608	2704	taskhostsys.exe	29
PID 2704 wrote to memory of 2608	2704	taskhostsys.exe	29
PID 2704 wrote to memory of 2608	2704	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_a6ef4f2df17738c9716de45599d1c1e1_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
280KB

MD5
7c479d543bf8f2b33d5d28a7e9c17c19

SHA1
21321c61000f40473228834012770b177ea08546

SHA256
7b32cd5ae9ecdafbb6b78ce8b3a93893e6c2e426764eb05173d89f0c0b1b45e0

SHA512
f2efdf99d16ea9a931c8b87a672e01053aed2b565b588d6c09aaf765efd1d5c061b296ebd0cebb2991f8b39aef9499ebb152f73cfd161e27fbeae603ae427cdc

Download Submit