Overview

overview

7

Static

static

3

2024-04-24...py.exe

windows7-x64

7

2024-04-24...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 10:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-24_38cccf94fdf7ba21744f5951507ef328_mafia_nionspy.exe

  • Size

    280KB

  • MD5

    38cccf94fdf7ba21744f5951507ef328

  • SHA1

    20f1be09b7db08d2ab458d1c1555c1ee094b54e4

  • SHA256

    c38b1f9959b417015d48f510149ad69cbc85315ffabbacb43aca98a35d4e7eaa

  • SHA512

    959c62b1869534499a1173507725e55a3ef09ce3215fa6828c2105dfed66269b11906ea7077f81b913fcb0a198788d0f86ca1fe839f287e21c292989abb56d5a

  • SSDEEP

    6144:LTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:LTBPFV0RyWl3h2E+7pl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-24_38cccf94fdf7ba21744f5951507ef328_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-24_38cccf94fdf7ba21744f5951507ef328_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe"
        3⤵
        • Executes dropped EXE
        PID:4144

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\taskhostsys.exe
          Filesize

          280KB

          MD5

          176884dbe891b976e065d46abe9cf02e

          SHA1

          618963fb403dafe3bf72d2c72d645a93dc413181

          SHA256

          65b3b96c697a408120db92df56a3d6af5524b2612a398a1aa2deb1423f0987dd

          SHA512

          6a33522c2f04d330dbfa1c5262c63894e5a8879ed36903fdcd243dd70952f60229d7088fbe19bbdb00c9897636f5c5114fed10df8ca1780d863ddc11a93a4f1a

          Download Submit