12ba2de52bccd2465c0635837d0ad7dab1b6229c905accdb410fa2b8475be4a5

Analysis

max time kernel
127s
max time network
136s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Size

1.3MB
MD5

fb174c77530db956bfa09cdb1393fb73
SHA1

8007630deda28ad03a4ba9fa025dd6f816d1eae4
SHA256

12ba2de52bccd2465c0635837d0ad7dab1b6229c905accdb410fa2b8475be4a5
SHA512

21508d63b7e7d90f99e74cdfd5cd79f184eb5cd0adb8f1c40a2d985f1056615583f51343a051730d47c12a8a2e2f56eee52b5481f74fa3f0d5fad0b9c37fe10c
SSDEEP

24576:y2TFU+CWYPMeXf1Z2TFU+CWYPMeXf1G2TFU+CWYPMeXf1Z2TFU+CWYPMeXf1:y2TarkCf1Z2TarkCf1G2TarkCf1Z2Taf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1600	wlogon32.exe
2876	wlogon32.exe

Loads dropped DLL 3 IoCs

pid	Process
1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
1600	wlogon32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\runas\command	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\open	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\open\command	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\DefaultIcon	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\open	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\runas	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\DefaultIcon	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\wlogon32.exe\" /START \"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\ = "Application"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\open\command	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\runas\command	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\ = "haldriver"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.exe\shell\runas	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1600	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1600	1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe	28
PID 1736 wrote to memory of 1600	1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe	28
PID 1736 wrote to memory of 1600	1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe	28
PID 1736 wrote to memory of 1600	1736	2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe	28
PID 1600 wrote to memory of 2876	1600	wlogon32.exe	29
PID 1600 wrote to memory of 2876	1600	wlogon32.exe	29
PID 1600 wrote to memory of 2876	1600	wlogon32.exe	29
PID 1600 wrote to memory of 2876	1600	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_fb174c77530db956bfa09cdb1393fb73_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\wlogon32.exe

Filesize
1.3MB

MD5
20fab7d880d80393e4c761a223ab2747

SHA1
67c6f643c0657031f270ba17cb6f5ac375b2e164

SHA256
75e8db4b383e660c1824e9c4269e683db60fdcd7b41ab90a9d7c96d722e1b131

SHA512
291c101b964b734f2ccc454ed0d41bd00ee07a83ad519957f1eb700c32b5f43fbe098528eced35529bf561f9fd6cd4e4955ee7fad8cc1b81949cb1c2fa76ad88

Download Submit