e4c63d9e8966895c9a787b4a739e78d2a900f4d26766eb0eda47a1b380756cba

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Size

327KB
MD5

8bb132c6a0572d67e787b5038d69e93c
SHA1

6d002ab85226ad6ed953609e901be89478369fc3
SHA256

e4c63d9e8966895c9a787b4a739e78d2a900f4d26766eb0eda47a1b380756cba
SHA512

4af7de388636903e73e42a2f076f6e1d7dde825a840ce2df2a004f6590ce8e764dd3e23f9c53e707600af5580da5a2ec46e7b7e2bc301f98a632ecc97983001a
SSDEEP

6144:j2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:j2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe

Executes dropped EXE 2 IoCs

pid	Process
2728	sidebar2.exe
2244	sidebar2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\runas\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\DefaultIcon\ = "%1"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\ = "prochost"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\runas	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\open	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\runas	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\runas\command\ = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\Content-Type = "application/x-msdownload"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\DefaultIcon	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\open\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\sidebar2.exe\" /START \"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\ = "Application"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\open\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\Content-Type = "application/x-msdownload"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\DefaultIcon\ = "%1"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\DefaultIcon	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\open	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\.exe\shell\runas\command	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\sidebar2.exe\" /START \"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2728	sidebar2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2728	2396	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	92
PID 2396 wrote to memory of 2728	2396	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	92
PID 2396 wrote to memory of 2728	2396	2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe	92
PID 2728 wrote to memory of 2244	2728	sidebar2.exe	93
PID 2728 wrote to memory of 2244	2728	sidebar2.exe	93
PID 2728 wrote to memory of 2244	2728	sidebar2.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-08_8bb132c6a0572d67e787b5038d69e93c_mafia_nionspy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe"
    3⤵
    - Executes dropped EXE
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\sidebar2.exe

Filesize
327KB

MD5
a2dc89a2048d283d3594b9556c08ea59

SHA1
2069dd6d5bac462e119047d7b8f45a2b918ea21c

SHA256
2c01d5cf19e7a18f20b29d01b5546c0e57b73b0c54428dda174c7e5493b89fec

SHA512
c2dc6326fc5b765efdbd269de0fafc9c66a173294f4f337458c6da9d36b59151261758487fc08504ca0956c933b613882649a5fd933439a51a5691bcb77f0fbf

Download Submit