Overview

overview

7

Static

static

3

2024-05-10...py.exe

windows7-x64

7

2024-05-10...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 14:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-10_b2a4bc47e1a4eeef5039db7de333aa03_mafia_nionspy.exe

  • Size

    280KB

  • MD5

    b2a4bc47e1a4eeef5039db7de333aa03

  • SHA1

    95ccfa6ceb07d2be160a0ded48775f81fc5b6acb

  • SHA256

    3a974d2b74564a7d1ee06289e363c929d91fda5bc33da0c0ef769d1177d8a842

  • SHA512

    a39cdbb269c8b5cebc7801addcb363afe763813ea48f67bc04257b11eac5e288c2615eda45518c77cc7c75a363f8202096289e634dfcd7875d1a8f63f934b0e8

  • SSDEEP

    6144:DTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:DTBPFV0RyWl3h2E+7pl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-10_b2a4bc47e1a4eeef5039db7de333aa03_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-10_b2a4bc47e1a4eeef5039db7de333aa03_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe"
        3⤵
        • Executes dropped EXE
        PID:3464

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\SView\taskhostsys.exe
          Filesize

          280KB

          MD5

          518b6ba49f1afefb46541c98a9652e9f

          SHA1

          16b8e08f04c5c189e3aafa31339b8ecfebb05d29

          SHA256

          d50657bfad538d4a3f8fe80063211abfaf14091eca9731a10a5ebb0e9cf5509e

          SHA512

          7a859081c6e6691487a4348d9860101e8868bfeee825a9f376e445208b4a0c8752542c7b452455ae0c14781c8aec561d59539a269d2cc5cbdcbff9e075363f75

          Download Submit