8a521e5b7fd0b754a64bd5ad4ba5450b97c9bcc22b751466faa73957e9ecaa23

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Size

280KB
MD5

be68dd2aee7b19c03d927d8dd8c41121
SHA1

80cca647de39ffb5d5222ab585d94ff777e0bc78
SHA256

8a521e5b7fd0b754a64bd5ad4ba5450b97c9bcc22b751466faa73957e9ecaa23
SHA512

923d6766179c75aade6dfc15a13515436e3d7b126407b1481537a00132f630e455567f875dfe2058f32309e9b8fc0d905f743913b7ac45b37f9707c01fdb53eb
SSDEEP

6144:qTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:qTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2916	wlogon32.exe
2440	wlogon32.exe

Loads dropped DLL 4 IoCs

pid	Process
2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
2916	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\ = "haldriver"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\ = "Application"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\DefaultIcon	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2916	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2916	2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe	28
PID 2304 wrote to memory of 2916	2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe	28
PID 2304 wrote to memory of 2916	2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe	28
PID 2304 wrote to memory of 2916	2304	2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe	28
PID 2916 wrote to memory of 2440	2916	wlogon32.exe	29
PID 2916 wrote to memory of 2440	2916	wlogon32.exe	29
PID 2916 wrote to memory of 2440	2916	wlogon32.exe	29
PID 2916 wrote to memory of 2440	2916	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe

Filesize
280KB

MD5
fb79b4de6a2353cbdb800b54f1dab769

SHA1
de18ce08fcb4655b298daafc7ae3e2ffbbb7f927

SHA256
b0877a8ec108bd58c589576eff350b5ea69a7c67b714c133f462c1d18cf4e001

SHA512
025e1f678ef4049b566e1fef9c15a2d82a900f3e5dc528b97771c865171b88fe625d7660e51b75ca71ef244ba4bea855a000df025d26da77afc94baf83d70b1a

Download Submit