Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe
-
Size
288KB
-
MD5
e349ae2bd8e6d7e8e47852c2a2bc8edc
-
SHA1
4e73a65380788ca4cabf63ae789ef7f88d1bc4ff
-
SHA256
9dee8eab9e86f148928de506ccaa80acb21bfa63fcb792d85c9a3572373ee924
-
SHA512
f63e8daaf6219b4fb9ccd48c782027e5150903c147707b19cdc1ec2a6efdbfa883c8bd4207090fff69eb2a9d6c74f960dda9965e1573f5571e379ab391f1fc80
-
SSDEEP
6144:SQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:SQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 1788 SearchIndexerDB.exe 1360 SearchIndexerDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\open 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\runas\command 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\Content-Type = "application/x-msdownload" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\DefaultIcon 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\runas\command 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\ = "cmos" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\open\command 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\DefaultIcon\ = "%1" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\runas 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\DefaultIcon 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\open 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\runas\command\ = "\"%1\" %*" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\.exe\shell\runas 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\ = "Application" 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\cmos\shell\open\command 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1788 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1788 2368 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe 80 PID 2368 wrote to memory of 1788 2368 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe 80 PID 2368 wrote to memory of 1788 2368 2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe 80 PID 1788 wrote to memory of 1360 1788 SearchIndexerDB.exe 81 PID 1788 wrote to memory of 1360 1788 SearchIndexerDB.exe 81 PID 1788 wrote to memory of 1360 1788 SearchIndexerDB.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_e349ae2bd8e6d7e8e47852c2a2bc8edc_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"3⤵
- Executes dropped EXE
PID:1360
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD526b5c45c56cd86ffba1e1cfe1f10346a
SHA1637e149445f0bcd495554077e178f5aac6e3f617
SHA256d017f0ca453280e9f82de0831ebdfe2bf439c74dd18aaabef39f4d4b5e6a4835
SHA512a9ac6fb7ebad08d7d83d6f6e54e60917823cffb08e4d98cd431e3a2fdee0ac8edeb2560a823eb4beb9a3e36400ec93ec917051c93c5b07b7eaa0faa23beac320