e6ccf713fdacf60e629c15f2b8061f2c4cbe120977bb6c765f9439ff733c6a23

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Size

348KB
MD5

5f0f052d01faf783e176682b529ee960
SHA1

24e7abc48f7ed82cead2409c6ee9c5049ff551d8
SHA256

e6ccf713fdacf60e629c15f2b8061f2c4cbe120977bb6c765f9439ff733c6a23
SHA512

f0b5b51792e567131bd235b5d8f6259f294a31db7c45c657e5160b7c6d006c13dfd54e810aba143685d1f51e2f31d372bcc0aff00f124825f193e18b5f17b88c
SSDEEP

6144:r2+JS2sFZfI8U0obHCW/2a7XQcsPMjVWr289gkPzDhmv:r2TFZfJiHCWBWPMjVWrHfmv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2464	taskhostsys.exe
2428	taskhostsys.exe

Loads dropped DLL 3 IoCs

pid	Process
2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\DefaultIcon	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\runas\command	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\ = "jitc"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\open\command	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\open	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\DefaultIcon\ = "%1"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\runas	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\ = "Application"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2464	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2464	2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe	28
PID 2612 wrote to memory of 2464	2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe	28
PID 2612 wrote to memory of 2464	2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe	28
PID 2612 wrote to memory of 2464	2612	2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe	28
PID 2464 wrote to memory of 2428	2464	taskhostsys.exe	29
PID 2464 wrote to memory of 2428	2464	taskhostsys.exe	29
PID 2464 wrote to memory of 2428	2464	taskhostsys.exe	29
PID 2464 wrote to memory of 2428	2464	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_5f0f052d01faf783e176682b529ee960_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
348KB

MD5
f5380bf9d3f6c3c39c1c68a5eb715f1a

SHA1
79b6385f3e1457bbb2b409ab812cdf6b980f447a

SHA256
4425c16e5b830e809000e17890431d5e0b496782604ea97e01e43ff82bf17dc7

SHA512
91daffa1333dbc1cd8de8d871d31e5589ae520bf229381425221d40ca1d1df5e43a02098ec00f948414a57d04c88b9c8fbd82faee909a308220bf507f8efbe35

Download Submit
memory/2428-44-0x00000000001F0000-0x000000000024C000-memory.dmp

Filesize
368KB

Download
memory/2428-46-0x00000000001F0000-0x000000000024C000-memory.dmp

Filesize
368KB

Download
memory/2464-43-0x00000000001F0000-0x000000000024C000-memory.dmp

Filesize
368KB

Download
memory/2464-45-0x00000000001F0000-0x000000000024C000-memory.dmp

Filesize
368KB

Download
memory/2612-0-0x0000000000050000-0x00000000000AC000-memory.dmp

Filesize
368KB

Download
memory/2612-33-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/2612-39-0x0000000000050000-0x00000000000AC000-memory.dmp

Filesize
368KB

Download
memory/2612-38-0x0000000002DA0000-0x0000000002DFC000-memory.dmp

Filesize
368KB

Download