c7efdac12a9f806d4f2f9ccd487087ad1c62e3ac8f8731c284a86c2d80bedac0

Analysis

max time kernel
123s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Size

344KB
MD5

820efc3760c657eeb706cbe636688480
SHA1

e2f6dddd6b7ee7b0366640f82868cb44a835094e
SHA256

c7efdac12a9f806d4f2f9ccd487087ad1c62e3ac8f8731c284a86c2d80bedac0
SHA512

fd594898c6e559c9b91997302e5795fe4fc4f80e435930e0b40f3cbb2f1d32bcbbbb573885ca44cd4afcd706598ae2324602458767196157a2c7f6509f6a8b2f
SSDEEP

6144:BTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:BTBPFV0RyWl3h2E+7pYm0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2176	winit32.exe
1800	winit32.exe

Loads dropped DLL 4 IoCs

pid	Process
2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
2176	winit32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winit32.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\runas\command	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\DefaultIcon\ = "%1"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\winit32.exe\" /START \"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\open	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\DefaultIcon	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\winit32.exe\" /START \"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\runas	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\open\command	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\open\command	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\runas	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\ = "ntdriver"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\ = "Application"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\DefaultIcon	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.exe\DefaultIcon\ = "%1"	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\open	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\ntdriver\shell\runas\command	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2176	winit32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2176	2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe	30
PID 2084 wrote to memory of 2176	2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe	30
PID 2084 wrote to memory of 2176	2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe	30
PID 2084 wrote to memory of 2176	2084	2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe	30
PID 2176 wrote to memory of 1800	2176	winit32.exe	31
PID 2176 wrote to memory of 1800	2176	winit32.exe	31
PID 2176 wrote to memory of 1800	2176	winit32.exe	31
PID 2176 wrote to memory of 1800	2176	winit32.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_820efc3760c657eeb706cbe636688480_mafia_nionspy.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe

Filesize
344KB

MD5
4436bc8efd3970d10a4cf9fb1c05102b

SHA1
c69eebcf18d346f63f5a4baa0df5241c25a239c4

SHA256
96051e54cb73bbbc537655d4d6e8c6ad124294504c08f3c5d11c2007a20c9f7e

SHA512
4dab17922c69461743c4b2b81eb2d61201d3afce772aa5222e82951d8edef8f84c1b6a7964eeaa7a7594c55103f0d8b979ae62df5f82264a6229073db70baa15

Download Submit