384741e58cbbbdc8673fcaf3b68493cffce3cd9cd1e48faac632d704556efa13

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Size

328KB
MD5

79e93742c1d1b799ff936b4b7b613110
SHA1

7a63a20235987196d1674e3284b223f452517ad9
SHA256

384741e58cbbbdc8673fcaf3b68493cffce3cd9cd1e48faac632d704556efa13
SHA512

231975584647fe5dbc5c87758b4b86fdb74fe83910219b5ac7718d71f1d7c7c8a12e8248b2d6de9c76bcc421c2ed5c778d943c53ad2f8d90e1f2ac9d8d51a912
SSDEEP

6144:t2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:t2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2576	SearchIndexerDB.exe
2856	SearchIndexerDB.exe

Loads dropped DLL 4 IoCs

pid	Process
2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
2576	SearchIndexerDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\runas\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\open\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\open	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\ = "cmos"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\runas	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\runas	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\DefaultIcon	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\open	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\runas\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\DefaultIcon	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\ = "Application"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\DefaultIcon\ = "%1"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\cmos\shell\open\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2576	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2576	2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	28
PID 2188 wrote to memory of 2576	2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	28
PID 2188 wrote to memory of 2576	2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	28
PID 2188 wrote to memory of 2576	2188	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	28
PID 2576 wrote to memory of 2856	2576	SearchIndexerDB.exe	29
PID 2576 wrote to memory of 2856	2576	SearchIndexerDB.exe	29
PID 2576 wrote to memory of 2856	2576	SearchIndexerDB.exe	29
PID 2576 wrote to memory of 2856	2576	SearchIndexerDB.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe

Filesize
328KB

MD5
e1bfaa5f98258ad219fa73e35368392c

SHA1
73d69f9ba46eaccf4e74c1397158ffaa8e5bf476

SHA256
a06cf9a62ca29c6bf60564dc2bfb82cbc5fe7de6d4f8e72c7040baf4f8967d14

SHA512
5c7385700c647bf804d586ec0f5424a56db4d09ad0af902c4c2aa1cc6239c1d764d68213376881b5993fe629dd65bea1084f6ad47e984945d5331de515cb7af9

Download Submit