1997e1e9c3d93bf68e028ad9e75740995b53cafb0873b4e9b4555848f2264028

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Size

328KB
MD5

7b532c41f9c0a70e62174ed38cbd9cd5
SHA1

fc8ebc06e1776241fe3a62bf160edb0eab4b6c52
SHA256

1997e1e9c3d93bf68e028ad9e75740995b53cafb0873b4e9b4555848f2264028
SHA512

7b7aaf9b4b740e35539e0bc02d08c779408017272ae89a876ab8a8f429f7c8722e978c3fa80061dce4db19e7a5960f27314907ca3f24362e47c735bc0cf53ee6
SSDEEP

6144:32+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:32TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2468	dwmsys.exe
2636	dwmsys.exe

Loads dropped DLL 4 IoCs

pid	Process
1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
2468	dwmsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\runas	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\open\command	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\DefaultIcon	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\runas\command	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\ = "Application"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\DefaultIcon\ = "%1"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\open	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "systemui"	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2468	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2468	1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe	28
PID 1912 wrote to memory of 2468	1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe	28
PID 1912 wrote to memory of 2468	1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe	28
PID 1912 wrote to memory of 2468	1912	2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe	28
PID 2468 wrote to memory of 2636	2468	dwmsys.exe	29
PID 2468 wrote to memory of 2636	2468	dwmsys.exe	29
PID 2468 wrote to memory of 2636	2468	dwmsys.exe	29
PID 2468 wrote to memory of 2636	2468	dwmsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_7b532c41f9c0a70e62174ed38cbd9cd5_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
328KB

MD5
a830082ef408363f971785663c822513

SHA1
b4d12028a2dd2b34786e9bb7c65984900e22c526

SHA256
994a517d418f1352ff6a7977ace62709576becc0e6b7bb50a75ffb61b384edce

SHA512
ee08a6569ef2eaa934d4db06279f936b08fecc0af61d0255c4b019db80c1387e36c89e6f5de6de586d15fb1a6dcd5e75b115cf4bb7f38979c99f5c5b2cf29d37

Download Submit