f17bb0197c25acacf3062a501d3dff3fe7ad91dc09ecef69e0edfba69636573c

Analysis

max time kernel
121s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Size

348KB
MD5

73e5a00a5f06aa7337b7dd9643f3cb9b
SHA1

2dd86b33881c6a8519e4d1d033f1a3b4326aad45
SHA256

f17bb0197c25acacf3062a501d3dff3fe7ad91dc09ecef69e0edfba69636573c
SHA512

6215c47ac25efad790acc82d00e9c8a54d889ea8cd1860cb130e044226250d2a190c1d777d82bc808278ca260f6fe00c684900a382665f2120b843f0e4c7ea63
SSDEEP

6144:e2+JS2sFZfI8U0obHCW/2a7XQcsPMjVWr289gkPzDhmv:e2TFZfJiHCWBWPMjVWrHfmv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2600	taskhostsys.exe
2736	taskhostsys.exe

Loads dropped DLL 4 IoCs

pid	Process
2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
2600	taskhostsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\DefaultIcon	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\ = "Application"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\taskhostsys.exe\" /START \"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\DefaultIcon\ = "%1"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "jitc"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\taskhostsys.exe\" /START \"%1\" %*"	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2600	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2600	2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2600	2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2600	2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe	28
PID 2020 wrote to memory of 2600	2020	2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe	28
PID 2600 wrote to memory of 2736	2600	taskhostsys.exe	29
PID 2600 wrote to memory of 2736	2600	taskhostsys.exe	29
PID 2600 wrote to memory of 2736	2600	taskhostsys.exe	29
PID 2600 wrote to memory of 2736	2600	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_73e5a00a5f06aa7337b7dd9643f3cb9b_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe

Filesize
348KB

MD5
27b96b23cb61ce6ea35f5eba9b19bed4

SHA1
62806bac4630acd09eab04999f5736701f5cb41f

SHA256
cb6b36d660a4a51c66c47d9fc6dfdc06af60c6f8fd2015cfa3a532cd57b1f55e

SHA512
ffeabf683256317f06004e9de169a7d9ff74b6f26843fc698da2cf2b333e0d0c41e2d5c670a0af39e0f17e0716b727fb81960b254757dccda462077db78aca88

Download Submit
memory/2020-0-0x00000000002A0000-0x00000000002FC000-memory.dmp

Filesize
368KB

Download
memory/2020-33-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/2020-41-0x0000000002720000-0x000000000277C000-memory.dmp

Filesize
368KB

Download
memory/2020-48-0x00000000002A0000-0x00000000002FC000-memory.dmp

Filesize
368KB

Download
memory/2020-40-0x0000000002720000-0x000000000277C000-memory.dmp

Filesize
368KB

Download
memory/2600-46-0x00000000003A0000-0x00000000003FC000-memory.dmp

Filesize
368KB

Download
memory/2600-50-0x00000000003A0000-0x00000000003FC000-memory.dmp

Filesize
368KB

Download
memory/2736-47-0x00000000003A0000-0x00000000003FC000-memory.dmp

Filesize
368KB

Download
memory/2736-49-0x00000000003A0000-0x00000000003FC000-memory.dmp

Filesize
368KB

Download