038275012a46fd0c0fd07e2350ed8f681619e99912811b0573ff8a2da5126e8a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Size

344KB
MD5

b6e769d9a6a547d496e2b0b1ee853fe7
SHA1

6b3f51757902dda538ce805e92d5927cd25e82eb
SHA256

038275012a46fd0c0fd07e2350ed8f681619e99912811b0573ff8a2da5126e8a
SHA512

445a2bf51afb3c68c038944ff6ad07bc641e02bbb934a4ad828be0453c39785f82ac603ef318ae05f402a378cebf2d11e81b87bcc250c2fc000f682511bebe6c
SSDEEP

6144:GTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:GTBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2684	SearchIndexerDB.exe
2744	SearchIndexerDB.exe

Loads dropped DLL 4 IoCs

pid	Process
2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
2684	SearchIndexerDB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\DefaultIcon	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\runas\command	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\open	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "cmos"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\ = "Application"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\DefaultIcon\ = "%1"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\open\command	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\runas	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2684	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2684	2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe	28
PID 2796 wrote to memory of 2684	2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe	28
PID 2796 wrote to memory of 2684	2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe	28
PID 2796 wrote to memory of 2684	2796	2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe	28
PID 2684 wrote to memory of 2744	2684	SearchIndexerDB.exe	29
PID 2684 wrote to memory of 2744	2684	SearchIndexerDB.exe	29
PID 2684 wrote to memory of 2744	2684	SearchIndexerDB.exe	29
PID 2684 wrote to memory of 2744	2684	SearchIndexerDB.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_b6e769d9a6a547d496e2b0b1ee853fe7_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe

Filesize
344KB

MD5
31312410c562b553daf8bedffbfa733f

SHA1
3525eef512cd47cba790ec81ff43e197954edf45

SHA256
0c23ef713ebed8220e69d3fb6edd5108514656e36a0af90dcc3d554ed3974110

SHA512
23609e4632f333945d7030ab1a0ca9528a734060e15cd0f3eea2f28887bbc1aad966861660634d2a0b32afef4aa5e1843b3fe77f79951b6822a45a87dbae8d51

Download Submit