4e7a4c94c4c6bb76518dcbaabe68ffb5a60dcb8d0029ad13da0d1be964fe55ad

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Size

344KB
MD5

c9fb346b3f19156b182b4456946088a4
SHA1

08f177caf8b259298f4c44b1bbc387f815453ff0
SHA256

4e7a4c94c4c6bb76518dcbaabe68ffb5a60dcb8d0029ad13da0d1be964fe55ad
SHA512

9a6e9f640d1d1e5bf65d2574dd20815beb0ba6594d6bfbbb054c98b19fa2603f042926d8a5de6d394d615797b5c53be8801e747e72d72f9cd04fc43ccf0c0758
SSDEEP

6144:3Tz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:3TBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2104	sidebar2.exe
2596	sidebar2.exe

Loads dropped DLL 4 IoCs

pid	Process
2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
2104	sidebar2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\runas\command	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\ = "prochost"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\sidebar2.exe\" /START \"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\ = "Application"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\Content-Type = "application/x-msdownload"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\open	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\open\command	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\DefaultIcon	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\sidebar2.exe\" /START \"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\runas	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\shell\runas\command\ = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\prochost\DefaultIcon\ = "%1"	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\DefaultIcon	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\shell\open	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2104	sidebar2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2104	2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe	28
PID 2028 wrote to memory of 2104	2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe	28
PID 2028 wrote to memory of 2104	2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe	28
PID 2028 wrote to memory of 2104	2028	2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe	28
PID 2104 wrote to memory of 2596	2104	sidebar2.exe	29
PID 2104 wrote to memory of 2596	2104	sidebar2.exe	29
PID 2104 wrote to memory of 2596	2104	sidebar2.exe	29
PID 2104 wrote to memory of 2596	2104	sidebar2.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_c9fb346b3f19156b182b4456946088a4_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe"
    3⤵
    - Executes dropped EXE
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\sidebar2.exe

Filesize
344KB

MD5
682d7a9ed555e348fef1d330123fa489

SHA1
bea833919d04dbb17140ce7add88496846863ca3

SHA256
00c9f3149aa1ab0ee3900e9b7dda81ddf0762cede28169b23f85209b4c13a036

SHA512
8ac67835a876a1c9e27745d9adb62fd0e70909c81446092b17919ad5e2d8145122e20d17c2249df5447aba2214603d5eb3e6a6c09c3ab67cc11c80cf061f7b2a

Download Submit