265cf4adc6b9bd39781975fe87cc4b624b9072f7de86cfaf8b86cde0536e7184

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Size

288KB
MD5

40ced9916caf6ee35620737a15d6985f
SHA1

49ee48f38b9a41124de984dd31a6f2b9d7cccbcc
SHA256

265cf4adc6b9bd39781975fe87cc4b624b9072f7de86cfaf8b86cde0536e7184
SHA512

e599c34873c24c75ed29273e704e662511f9e2955f1923855da2489e7ceb5f978efc43ee23689297fcb0dbb27d2b602575bed5c137fa9da0dd59e979bfaab6c9
SSDEEP

6144:XQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:XQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2500	sidebar2.exe
2572	sidebar2.exe

Loads dropped DLL 4 IoCs

pid	Process
1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
2500	sidebar2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\DefaultIcon	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\runas\command\ = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\sidebar2.exe\" /START \"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\Content-Type = "application/x-msdownload"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\open\command	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\sidebar2.exe\" /START \"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\runas\command	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\ = "prochost"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\ = "Application"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\runas	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\open\command	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\DefaultIcon\ = "%1"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\prochost\shell\open	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\DefaultIcon	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2500	sidebar2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2500	1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe	28
PID 1544 wrote to memory of 2500	1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe	28
PID 1544 wrote to memory of 2500	1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe	28
PID 1544 wrote to memory of 2500	1544	2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe	28
PID 2500 wrote to memory of 2572	2500	sidebar2.exe	29
PID 2500 wrote to memory of 2572	2500	sidebar2.exe	29
PID 2500 wrote to memory of 2572	2500	sidebar2.exe	29
PID 2500 wrote to memory of 2572	2500	sidebar2.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_40ced9916caf6ee35620737a15d6985f_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe"
    3⤵
    - Executes dropped EXE
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\sidebar2.exe

Filesize
288KB

MD5
8292e15b7d7c8940781b2ee4c12c2b2c

SHA1
bcfdc52186f40196ab6ff8461fd72944cbc10681

SHA256
4d9273ee5c801dc3ec92b696d69fb52b83da674093ab66e814fb38c65396d29b

SHA512
d137565c2b5d5a5a9a7a2368fc288d16e7916a79530fde51d538b684a60ae57a8ad7fd3f6324b5fd4194fa2c74a91b0948315e498fd7a9233cd1c2456e6e494a

Download Submit