9f6c0957708ca9292b7b1e8107fdc66a6841ee9fd228061e4fbef2e7c558b093

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Size

327KB
MD5

04ebd5478863d005321273a2506b2d69
SHA1

2da00a31390988166a4ca0ca8c83438e1c1df5ba
SHA256

9f6c0957708ca9292b7b1e8107fdc66a6841ee9fd228061e4fbef2e7c558b093
SHA512

6f4eeda6999f675d7222b46aa6996f8028f1e04d0cc4d8fc2d422b72054a80d542dbaa92a5ec633c288918cc2664dd3a428fe905c2bdda465966ec0904ddde02
SSDEEP

6144:a2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:a2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2576	csrssys.exe
2852	csrssys.exe

Loads dropped DLL 3 IoCs

pid	Process
1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\open	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\runas	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\open	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\runas	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\ = "Application"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\DefaultIcon\ = "%1"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\ = "wexplorer"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\DefaultIcon	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\open\command	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\csrssys.exe\" /START \"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\DefaultIcon	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\csrssys.exe\" /START \"%1\" %*"	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\open\command	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\wexplorer\shell\runas\command	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.exe\shell\runas\command	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2576	csrssys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2576	1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe	28
PID 1408 wrote to memory of 2576	1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe	28
PID 1408 wrote to memory of 2576	1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe	28
PID 1408 wrote to memory of 2576	1408	2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe	28
PID 2576 wrote to memory of 2852	2576	csrssys.exe	29
PID 2576 wrote to memory of 2852	2576	csrssys.exe	29
PID 2576 wrote to memory of 2852	2576	csrssys.exe	29
PID 2576 wrote to memory of 2852	2576	csrssys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_04ebd5478863d005321273a2506b2d69_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe"
    3⤵
    - Executes dropped EXE
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe

Filesize
173KB

MD5
ca39404047f7e18401ce94cc2a74126d

SHA1
452cff529ebbcbfe3fdc10ed1aa4da7c2a5dbdb6

SHA256
186f1c92313b7b3998828c97e2da6881054164ae9d66a2e48ab3fa99e78c5e3d

SHA512
df9759ffc0400175f14a709355d3cce23dd92e816babe5db82fb28591f3213b513ffdeb83a39e7d328e705ed6a1a4120ad400f97637d5fe034ed03c8490cd8e4

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\csrssys.exe

Filesize
327KB

MD5
43b00210f4cfc934613bfaaa08f03283

SHA1
77eb0c47ff07e3d8fa52f3657e116fbc683f021d

SHA256
31aceef01e8ddf07e21470a00fc68af2ba408ab89caa32bb6c9b6ae6173a09c4

SHA512
da05afc3e3db6e1b3323752a840546b44fd97b16ab6cbd877ba9b47eb59d3c670884a3356bd09637e07d768f945af496d680ce5b3e6066d257c869b30cac3ef3

Download Submit