e8bf2ea8e88039b5e5a51cf96e38ebb1b62109d1856424bb1381fe9fdcf91a3a

Analysis

max time kernel
121s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Size

328KB
MD5

0c609311f81d342d58051239819f74b6
SHA1

5da0fb997c35276b1d74bb63bca84a20abbe1997
SHA256

e8bf2ea8e88039b5e5a51cf96e38ebb1b62109d1856424bb1381fe9fdcf91a3a
SHA512

fe17df2c5abc7cb3c4f84e58f598fa3ff29f49433555a59c204f03d05898c49cfcc764f419a36ca74b206a6b87388aaf7a02221f9d7ad4a6e09fb21960269e76
SSDEEP

6144:G2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:G2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2628	winit32.exe
2044	winit32.exe

Loads dropped DLL 4 IoCs

pid	Process
2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
2628	winit32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "ntdriver"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\DefaultIcon	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\ = "Application"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\winit32.exe\" /START \"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\DefaultIcon\ = "%1"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\winit32.exe\" /START \"%1\" %*"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2628	winit32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2628	2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2628	2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2628	2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe	28
PID 2920 wrote to memory of 2628	2920	2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe	28
PID 2628 wrote to memory of 2044	2628	winit32.exe	29
PID 2628 wrote to memory of 2044	2628	winit32.exe	29
PID 2628 wrote to memory of 2044	2628	winit32.exe	29
PID 2628 wrote to memory of 2044	2628	winit32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe

Filesize
328KB

MD5
6836d3acba6a99c98e709e6e6e401f5b

SHA1
249345bb0d2b05a86cf3ac8bf6bac178aab6ab3a

SHA256
f635f14ef36ac27be1c6b35d6df4bb8c9f959cfe8a34b27e788f48e3dbc457d3

SHA512
a5d000ef44ae3c3341232f25dd09ec998cb5b77175881daabb5c0af852660bfdbde29845b371448f09c34cbac1f44f05170469cf6348ed61b2b9b2f2a0373013

Download Submit