Overview

overview

7

Static

static

3

2024-05-09...py.exe

windows7-x64

7

2024-05-09...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-09_2c1e8b2fd2767df6807d43ddcef6b370_mafia_nionspy.exe

  • Size

    328KB

  • MD5

    2c1e8b2fd2767df6807d43ddcef6b370

  • SHA1

    fc3ba30e2d112de6b8a518268fd860c4567b9f57

  • SHA256

    2bc4c34f17b1e5d8dd7f8260e485ad3e905dd7e7b37409575b96cfb4f460dd95

  • SHA512

    cf82048aed963e64bbef69cf87d2d211f75c1fc0c2e813873cae003d931d17d74d5654ac844e3a690c91deda8a8b0af3e81edaf614186a0b164ac42c2b059a7d

  • SSDEEP

    6144:U2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:U2TFafJiHCWBWPMjVWrXf1v

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-09_2c1e8b2fd2767df6807d43ddcef6b370_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-09_2c1e8b2fd2767df6807d43ddcef6b370_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3304
      • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"
        3⤵
        • Executes dropped EXE
        PID:4688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
          Filesize

          328KB

          MD5

          956b08a9c4994a7da2770fa3e6fd2df0

          SHA1

          520cf42937a8554a4a04b91e307c9d91c06aa73b

          SHA256

          a3548c98487b9868689f6933bdeac93dcce7f94688f0dfa88fc7785eefe898ed

          SHA512

          7afecdd2a413a53392a9a7580a8df8ce44c8520a4e0858e4cd17244746042939bb69f6c8f2a20a2be3a35410d6b9a5186d25b896b85a5138ba281ee817f66293

          Download Submit