Overview

overview

7

Static

static

3

2024-03-09...py.exe

windows7-x64

7

2024-03-09...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-09_0a6f374e4e9c18fa0206731d2882cd10_mafia_nionspy.exe

  • Size

    274KB

  • MD5

    0a6f374e4e9c18fa0206731d2882cd10

  • SHA1

    874c8fb1becce92b6d995e5cfb3880f18407f3ca

  • SHA256

    00371caf883ccdb7812c778730dd92956e75683883b76839649e5832602b0add

  • SHA512

    1a4a157034bcce43b8fbf522d14a32369721ca814ab86882d8151e80e08ff92119f4b1d0206a46d0c7c97abe4c7db70f4418ef232c68782de920377b369e1742

  • SSDEEP

    6144:0YvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:0YvEbrUjp3SpWggd3JBPlPDIQ3g

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-09_0a6f374e4e9c18fa0206731d2882cd10_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-09_0a6f374e4e9c18fa0206731d2882cd10_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
        3⤵
        • Executes dropped EXE
        PID:3196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
    Filesize

    274KB

    MD5

    0499b1da898c86cf47cfa0e57d47ff09

    SHA1

    196efc7122cec3e334a3ffaf8fd2c0fd20db40c3

    SHA256

    330aa375d5449ad542142c3598557a85660c0071b4d42cf754abb7f37a291909

    SHA512

    f1453ceb2fe3f2529c799a15d588ac20e767712e1e05adf4f49dc954fb9b61d54e0f25ed33f9fecd0dec34472a9aee2d79f272281046820dd6f7ee9d3a75519d

    Download Submit