Overview

overview

7

Static

static

3

2024-05-23...py.exe

windows7-x64

7

2024-05-23...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_ceb8d72171999b8d9901f10e0d90103d_mafia_nionspy.exe

  • Size

    280KB

  • MD5

    ceb8d72171999b8d9901f10e0d90103d

  • SHA1

    cc46b41b3005a8dafa3cdcf871c27d9da582080c

  • SHA256

    3b4cf516bd4119cbbdcf878b99d6094963fe0cac3dd51a0cc9d61a0ac2c3a6b6

  • SHA512

    fbedff636a02fc4354fbafc0b1fef21fdfb2e6e5325b1536e2499c14bb0a64e506d009d2ca57e8919b1e793a2b5eaf51157c6130137b3471931f01ed92eea8b5

  • SSDEEP

    6144:RQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:RQMyfmNFHfnWfhLZVHmOog

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_ceb8d72171999b8d9901f10e0d90103d_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_ceb8d72171999b8d9901f10e0d90103d_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"
        3⤵
        • Executes dropped EXE
        PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe
    Filesize

    280KB

    MD5

    54af5b1fa551822311d463ef79ac4e14

    SHA1

    cf4abbec06184444c343274630ea036f1eba516d

    SHA256

    ea2086810dbeefedea1e32e3b56de516f3e3780623651444d977fd0ea458cb35

    SHA512

    eaa58c1aad83b19f2406053d43dcf262283922f4421bb5690c3c3b77ff012a57a562947c3b9646f2045998574bdc2217fa9a12b2ea91ec464c9f04bb629850f2

    Download Submit