e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Size

344KB
MD5

49c1103d13de84ed54806eb41f82b0fb
SHA1

06773fea288001c1612669989560c65e298f4bd7
SHA256

e6ce4804c8558d7e16b753b77c6b70c813c8aa0e09edd94b8c1daa48405a82b2
SHA512

e5fe03bb2c75c24e2e633b0febef95a1a199d60d81639ebe9f5dcdb76d7ce61eaf3cf02bdb237f1b9976357ae9b81f081f3e15384141253f1c4ba91e5f2b9464
SSDEEP

6144:pTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:pTBPFV0RyWl3h2E+7pYm0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2668	dwmsys.exe
2812	dwmsys.exe

Loads dropped DLL 4 IoCs

pid	Process
2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
2668	dwmsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\open	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\DefaultIcon	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\ = "systemui"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\DefaultIcon	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\runas	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\ = "Application"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\DefaultIcon\ = "%1"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\open\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\runas\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\open	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\runas\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\runas	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\open\command	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2668	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2668	2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	28
PID 2180 wrote to memory of 2668	2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	28
PID 2180 wrote to memory of 2668	2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	28
PID 2180 wrote to memory of 2668	2180	2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe	28
PID 2668 wrote to memory of 2812	2668	dwmsys.exe	29
PID 2668 wrote to memory of 2812	2668	dwmsys.exe	29
PID 2668 wrote to memory of 2812	2668	dwmsys.exe	29
PID 2668 wrote to memory of 2812	2668	dwmsys.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_49c1103d13de84ed54806eb41f82b0fb_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
344KB

MD5
84bd02621aa60ed672d501052e8e7676

SHA1
8f7fb60f8a359cfc412f1119a22d58b855af54fe

SHA256
c8ecf1c4a464edee92c9a93bc53b0ed1f9fc0558f4f193302bb30a8ab67e1677

SHA512
9aa237c17a071d78b08e3cd268dad0637c4a1f2c11c16a44a7c8286b9413ed62d0e76a192e93ead9bdb7166fc3fceb4176d4f4e49b42afc0b9b3b0c0a5d39bda

Download Submit