384741e58cbbbdc8673fcaf3b68493cffce3cd9cd1e48faac632d704556efa13

Analysis

max time kernel
144s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Size

328KB
MD5

79e93742c1d1b799ff936b4b7b613110
SHA1

7a63a20235987196d1674e3284b223f452517ad9
SHA256

384741e58cbbbdc8673fcaf3b68493cffce3cd9cd1e48faac632d704556efa13
SHA512

231975584647fe5dbc5c87758b4b86fdb74fe83910219b5ac7718d71f1d7c7c8a12e8248b2d6de9c76bcc421c2ed5c778d943c53ad2f8d90e1f2ac9d8d51a912
SSDEEP

6144:t2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:t2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe

Executes dropped EXE 2 IoCs

pid	Process
1644	wlogon32.exe
1368	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\ = "Application"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\open\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\runas\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\Content-Type = "application/x-msdownload"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\Content-Type = "application/x-msdownload"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\DefaultIcon\ = "%1"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\wlogon32.exe\" /START \"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\runas\command\ = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\ = "haldriver"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\DefaultIcon	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\open	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\runas	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\DefaultIcon	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\open	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\open\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\runas\command	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\DefaultIcon\ = "%1"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\wlogon32.exe\" /START \"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.exe\shell\runas	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1644	wlogon32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1644	4804	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	90
PID 4804 wrote to memory of 1644	4804	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	90
PID 4804 wrote to memory of 1644	4804	2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe	90
PID 1644 wrote to memory of 1368	1644	wlogon32.exe	91
PID 1644 wrote to memory of 1368	1644	wlogon32.exe	91
PID 1644 wrote to memory of 1368	1644	wlogon32.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_79e93742c1d1b799ff936b4b7b613110_mafia_nionspy.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\wlogon32.exe

Filesize
328KB

MD5
f34f5a0fdc8de3a0d37de2ab032189fb

SHA1
28eda44ac837ca971de8a8c5b602248b69f1f4ad

SHA256
5c99941efd3ad1e759c4794ec4cba3e8b029950c3d9a9fc643b43de4de348eee

SHA512
8eda3b96d4d84c51b68ce094b0642db373795977d1026945aa17865719d1dfab5056158d1031e0019cb7767ec07df1e82743a6ef57cbc18b8528c671dc33453e

Download Submit