Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 00:36

General

  • Target

    2024-05-25_5cca93d10c29f3ee1bc0bf38e57d5033_mafia_nionspy.exe

  • Size

    280KB

  • MD5

    5cca93d10c29f3ee1bc0bf38e57d5033

  • SHA1

    dc4188791508407f0a31818b18ec05e61efe1635

  • SHA256

    3ff7f458246b1581a908a35cb44bcb65ab407cd77d86dc8892f5086e8140fb0c

  • SHA512

    35c2efd93c80262849f0a72c46fdf6d4ce8bf2dc174236951b2b1ab7c04c7e43009d79e53053905944c1031ae6fbbf17e65dd433e705c462bfdb53fea72bc028

  • SSDEEP

    6144:PQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:PQMyfmNFHfnWfhLZVHmOog

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_5cca93d10c29f3ee1bc0bf38e57d5033_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5cca93d10c29f3ee1bc0bf38e57d5033_mafia_nionspy.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 448
      2⤵
      • Program crash
      PID:2660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads