3e1de46920dd3f27b355ccac40dab6934c56c6ce7b40d23734e7242dae7bd157

Analysis

max time kernel
121s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Size

328KB
MD5

970043f1c87524cc588c027fa182f855
SHA1

fc61a492a72995d016619fac2b8afbb715e25635
SHA256

3e1de46920dd3f27b355ccac40dab6934c56c6ce7b40d23734e7242dae7bd157
SHA512

e234e0e6cd4e8667856e54142557f7e9795ca657a8c117e02fcd1c38de40803b61b23b38d6273a2c2ad97aac8151301a0a9ed63cc07a153cf4c094b8c366db3c
SSDEEP

6144:g2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:g2TFafJiHCWBWPMjVWrXf1v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2648	sidebar2.exe
2608	sidebar2.exe

Loads dropped DLL 4 IoCs

pid	Process
2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
2648	sidebar2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\sidebar2.exe\" /START \"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\runas	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\DefaultIcon	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\runas\command	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "prochost"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\sidebar2.exe\" /START \"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\open	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\Content-Type = "application/x-msdownload"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\open\command	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\DefaultIcon\ = "%1"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\ = "Application"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost\shell\runas\command\ = "\"%1\" %*"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\prochost	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2648	sidebar2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2648	2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe	28
PID 2976 wrote to memory of 2648	2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe	28
PID 2976 wrote to memory of 2648	2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe	28
PID 2976 wrote to memory of 2648	2976	2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe	28
PID 2648 wrote to memory of 2608	2648	sidebar2.exe	29
PID 2648 wrote to memory of 2608	2648	sidebar2.exe	29
PID 2648 wrote to memory of 2608	2648	sidebar2.exe	29
PID 2648 wrote to memory of 2608	2648	sidebar2.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-25_970043f1c87524cc588c027fa182f855_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"
    3⤵
    - Executes dropped EXE
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe

Filesize
328KB

MD5
1316ae8c96af983fa858e7b7d4ab0bb1

SHA1
17a91373d4853a7252f03514538beb8409cf95aa

SHA256
b3a8920f5796dc59da3d302d8060eb43a5f250912d056af1599543c2f6c88d5f

SHA512
96a9ec09996063f22ccdddf63388f990f325945ae2ffcbb44c9b94ce7342ce66a3579660a415e7b69456ff333b0f8f7571406066a3a2bb17b9deb084b715366e

Download Submit