daa74db3bc5a2788d34aa5a3e8c13c0a77d133f17d0c8f52926fe18ec9e96f3d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Size

280KB
MD5

fccf66274874898196ba9cb6847f37d6
SHA1

dfd56a47476ed62f4728a3fa84a855e7538e0f83
SHA256

daa74db3bc5a2788d34aa5a3e8c13c0a77d133f17d0c8f52926fe18ec9e96f3d
SHA512

0628f76ccc304efb0bfeb3793108ca4fd2a950d87c40a2c73028e5b5507262aa8e01b702db46ac9e4e649bf47fb0100d61531fe2f14a2a7fd35754b1f09965c4
SSDEEP

6144:yQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:yQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2064	wlogon32.exe
2616	wlogon32.exe

Loads dropped DLL 4 IoCs

pid	Process
2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
2064	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\ = "haldriver"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\DefaultIcon	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\open\command	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\open	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\runas\command	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\DefaultIcon	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\wlogon32.exe\" /START \"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\wlogon32.exe\" /START \"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\shell\runas	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\ = "Application"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2064	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2064	2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe	28
PID 2316 wrote to memory of 2064	2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe	28
PID 2316 wrote to memory of 2064	2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe	28
PID 2316 wrote to memory of 2064	2316	2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe	28
PID 2064 wrote to memory of 2616	2064	wlogon32.exe	29
PID 2064 wrote to memory of 2616	2064	wlogon32.exe	29
PID 2064 wrote to memory of 2616	2064	wlogon32.exe	29
PID 2064 wrote to memory of 2616	2064	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_fccf66274874898196ba9cb6847f37d6_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\wlogon32.exe

Filesize
280KB

MD5
c5136107162a1741d17221aed4223351

SHA1
c306e08df70d6e73708d19c0d1a9c458f3905b27

SHA256
67d66cd4171f28acd9a4e97f03cb531ffee5d8f7a872c1aa2b9b542f60a95495

SHA512
d93ea42eb300982ed3b55cddac285632339f3f1b839366fced67c5777f54f0cd9f9c67737a22d16b08d336b6754faaa2f60ceb413d9f42917b6cb1a2b16f90df

Download Submit