Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe
-
Size
274KB
-
MD5
61ad0c28260978bdd59d804d778af0fa
-
SHA1
6fd27e5dda69a831dcbc55400c50bf289f779bac
-
SHA256
7cc5954adf678252411b419b50644ef4738203d7671545e17f17a76e32c0f432
-
SHA512
d52b6393acbe2231b6f156aa3b7f49be46543f2334a68ed32ed0bd5619400ffb91a9cebd1722a0fd8aaa287a9f26ad0cfe332dfe4711c0f22d633000d41c4018
-
SSDEEP
6144:CYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:CYvEbrUjp3SpWggd3JBPlPDIQ3g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 2572 csrssys.exe 4324 csrssys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\ = "Application" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\runas 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\runas\command\ = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\runas\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\DefaultIcon 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\ = "wexplorer" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\open\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\Content-Type = "application/x-msdownload" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\DefaultIcon\ = "%1" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\csrssys.exe\" /START \"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\runas 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\open\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\open 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\open 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\runas\command 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\csrssys.exe\" /START \"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\DefaultIcon 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.exe\shell 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2572 csrssys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3124 wrote to memory of 2572 3124 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 83 PID 3124 wrote to memory of 2572 3124 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 83 PID 3124 wrote to memory of 2572 3124 2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe 83 PID 2572 wrote to memory of 4324 2572 csrssys.exe 84 PID 2572 wrote to memory of 4324 2572 csrssys.exe 84 PID 2572 wrote to memory of 4324 2572 csrssys.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_61ad0c28260978bdd59d804d778af0fa_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"3⤵
- Executes dropped EXE
PID:4324
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD52a0f7de65be1c69c3a557ab720302a2f
SHA167d0016c73498a667c60048910f58413e000728d
SHA2569675250a924c3e4bb98505c5bf33eb515b100460dbbd9375ec8fdedd201cdd01
SHA512b727e2b1730f5a98ddd71d4db2069343abaea1fff00da86acf25af45dcfae450855d952b3cfd1116aef51c6a942be85a11aab74432f6161b21dce68128e003cd