Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe
-
Size
280KB
-
MD5
be68dd2aee7b19c03d927d8dd8c41121
-
SHA1
80cca647de39ffb5d5222ab585d94ff777e0bc78
-
SHA256
8a521e5b7fd0b754a64bd5ad4ba5450b97c9bcc22b751466faa73957e9ecaa23
-
SHA512
923d6766179c75aade6dfc15a13515436e3d7b126407b1481537a00132f630e455567f875dfe2058f32309e9b8fc0d905f743913b7ac45b37f9707c01fdb53eb
-
SSDEEP
6144:qTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:qTBPFV0RyWl3h2E+7pl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2916 wlogon32.exe 2440 wlogon32.exe -
Loads dropped DLL 4 IoCs
pid Process 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 2916 wlogon32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\ = "haldriver" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\ = "Application" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\DefaultIcon 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas\command 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\runas 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\DefaultIcon\ = "%1" 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\haldriver\shell\open 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2916 wlogon32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2916 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 28 PID 2304 wrote to memory of 2916 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 28 PID 2304 wrote to memory of 2916 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 28 PID 2304 wrote to memory of 2916 2304 2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe 28 PID 2916 wrote to memory of 2440 2916 wlogon32.exe 29 PID 2916 wrote to memory of 2440 2916 wlogon32.exe 29 PID 2916 wrote to memory of 2440 2916 wlogon32.exe 29 PID 2916 wrote to memory of 2440 2916 wlogon32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_be68dd2aee7b19c03d927d8dd8c41121_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"3⤵
- Executes dropped EXE
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5fb79b4de6a2353cbdb800b54f1dab769
SHA1de18ce08fcb4655b298daafc7ae3e2ffbbb7f927
SHA256b0877a8ec108bd58c589576eff350b5ea69a7c67b714c133f462c1d18cf4e001
SHA512025e1f678ef4049b566e1fef9c15a2d82a900f3e5dc528b97771c865171b88fe625d7660e51b75ca71ef244ba4bea855a000df025d26da77afc94baf83d70b1a