Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
-
Size
274KB
-
MD5
61ad0c28260978bdd59d804d778af0fa
-
SHA1
6fd27e5dda69a831dcbc55400c50bf289f779bac
-
SHA256
7cc5954adf678252411b419b50644ef4738203d7671545e17f17a76e32c0f432
-
SHA512
d52b6393acbe2231b6f156aa3b7f49be46543f2334a68ed32ed0bd5619400ffb91a9cebd1722a0fd8aaa287a9f26ad0cfe332dfe4711c0f22d633000d41c4018
-
SSDEEP
6144:CYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:CYvEbrUjp3SpWggd3JBPlPDIQ3g
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2532 lsassys.exe 2636 lsassys.exe -
Loads dropped DLL 4 IoCs
pid Process 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 2532 lsassys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\open 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\runas\command\ = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\DefaultIcon\ = "%1" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\runas\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\ = "Application" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\open\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\ = "halnt" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\DefaultIcon 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\open 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\DefaultIcon 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\lsassys.exe\" /START \"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\runas 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\open\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\Content-Type = "application/x-msdownload" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\halnt\shell\runas\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.exe\shell\runas 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2532 lsassys.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 808 wrote to memory of 2532 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 28 PID 808 wrote to memory of 2532 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 28 PID 808 wrote to memory of 2532 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 28 PID 808 wrote to memory of 2532 808 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 28 PID 2532 wrote to memory of 2636 2532 lsassys.exe 29 PID 2532 wrote to memory of 2636 2532 lsassys.exe 29 PID 2532 wrote to memory of 2636 2532 lsassys.exe 29 PID 2532 wrote to memory of 2636 2532 lsassys.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\lsassys.exe"3⤵
- Executes dropped EXE
PID:2636
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD5c5e3f3a4f751d65f9f4d5734d4a0d0e7
SHA1046f16bd3de11addadf659ed59a5f12132d11457
SHA256523c4952888204469401676761fc44a0ed632db4aa3d2f5d97942fb5df4cfc02
SHA512d44e414e6f07295cd83732c88efcc32c990ebee15506648d559f283b1b00064b0feb62a38f474fee66e03ab31b71cd8d996f0ebc3866233a9fed5144540097f1