e4c63d9e8966895c9a787b4a739e78d2a900f4d26766eb0eda47a1b380756cba

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Size

327KB
MD5

8bb132c6a0572d67e787b5038d69e93c
SHA1

6d002ab85226ad6ed953609e901be89478369fc3
SHA256

e4c63d9e8966895c9a787b4a739e78d2a900f4d26766eb0eda47a1b380756cba
SHA512

4af7de388636903e73e42a2f076f6e1d7dde825a840ce2df2a004f6590ce8e764dd3e23f9c53e707600af5580da5a2ec46e7b7e2bc301f98a632ecc97983001a
SSDEEP

6144:j2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:j2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2528	winit32.exe
2688	winit32.exe

Loads dropped DLL 3 IoCs

pid	Process
2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\open	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\winit32.exe\" /START \"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\runas	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\ = "ntdriver"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\DefaultIcon	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\DefaultIcon\ = "%1"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\winit32.exe\" /START \"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\DefaultIcon	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\ = "Application"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\runas\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\runas	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.exe\shell\open\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell\open\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\ntdriver\shell	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2528	winit32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2528	2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	28
PID 2352 wrote to memory of 2528	2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	28
PID 2352 wrote to memory of 2528	2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	28
PID 2352 wrote to memory of 2528	2352	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	28
PID 2528 wrote to memory of 2688	2528	winit32.exe	29
PID 2528 wrote to memory of 2688	2528	winit32.exe	29
PID 2528 wrote to memory of 2688	2528	winit32.exe	29
PID 2528 wrote to memory of 2688	2528	winit32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\winit32.exe

Filesize
327KB

MD5
2aafca8aed29be7d0eea77972f04c489

SHA1
c6e7874b07652cddedd2f706e9bff0052a0c3257

SHA256
48969581ae7206d2017ecda1c797867427f3e2d632328d451ca255ea85dd98c7

SHA512
6bd1a16e17e31831d55c662c18023dfb577bb460956b3d33e4623d54cbad64a1412a3b99eb0ade640e8dac3e635f6b2f60a7e2095687d81369a3988bb48c87f5

Download Submit