f0f349cad9369a5bdcf6904def30a898a491a31752a5ec343d069685ab3ac618

Analysis

max time kernel
121s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Size

280KB
MD5

1d8470c9ff868f50f6d4e887006c8fa7
SHA1

8687cd1581d7ce4eb26272078a3cdd96aed6a50c
SHA256

f0f349cad9369a5bdcf6904def30a898a491a31752a5ec343d069685ab3ac618
SHA512

db13b9a5db8de01b5b1b9584bef974cd0be77597c06a1eb28ad9749cea89c23c1db88906c81fc3a2a97dfc96d3d88ee6d8fb63bbada083a1f7d657dde3e8ce40
SSDEEP

6144:vTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:vTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2556	SearchIndexerDB.exe
2576	SearchIndexerDB.exe

Loads dropped DLL 3 IoCs

pid	Process
2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\DefaultIcon	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\DefaultIcon\ = "%1"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\ = "Application"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\open	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\ = "cmos"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\open\command	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\DefaultIcon	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\runas\command	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\runas	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\runas\command	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell\open\command	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\cmos\shell	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\open	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.exe\shell\runas	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2556	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2556	2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe	28
PID 2152 wrote to memory of 2556	2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe	28
PID 2152 wrote to memory of 2556	2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe	28
PID 2152 wrote to memory of 2556	2152	2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe	28
PID 2556 wrote to memory of 2576	2556	SearchIndexerDB.exe	29
PID 2556 wrote to memory of 2576	2556	SearchIndexerDB.exe	29
PID 2556 wrote to memory of 2576	2556	SearchIndexerDB.exe	29
PID 2556 wrote to memory of 2576	2556	SearchIndexerDB.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\SearchIndexerDB.exe

Filesize
280KB

MD5
7b74ad37bde1551a7fdef7ec10cd8cf9

SHA1
8d4e084d92e41dff5f29a95415e265efa1488fb7

SHA256
828c345ca148ecdc81dd503b487d8393eaf7e636c58c0aaa7485d370e29c0456

SHA512
60d2104ad1736affbf9ef03ef4bde91fdbe909c640f632258e5c6ac22f8cc8524a5aed2d83d5b35895e19d306323ccb8188c40a7309b539c10d1337d30b56bb3

Download Submit