Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe
-
Size
344KB
-
MD5
8e261b67fcd36b84bbf35112caa67f24
-
SHA1
223bf3d5dea2774c944194d8f85579ded09c57b0
-
SHA256
a8206adbaab94415db7a14283cd510b3dc67679781d4d838eba8b3d6fe7514ff
-
SHA512
85b881d242598f7c57e5acb0839771fc9fac29e75ce536a001a130f4dd403b7eed375b6b822a456cfbe09c8425f6d89fa09486423411b89820ba5f3d5da9490c
-
SSDEEP
6144:tTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:tTBPFV0RyWl3h2E+7pYm0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2532 csrssys.exe 2148 csrssys.exe -
Loads dropped DLL 4 IoCs
pid Process 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 2532 csrssys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\ = "wexplorer" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\DefaultIcon\ = "%1" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\DefaultIcon\ = "%1" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\ = "Application" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\DefaultIcon 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\runas 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open\command 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell\open 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\shell 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1528014236-771305907-3973026625-1000_CLASSES\.exe\DefaultIcon 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2532 csrssys.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 868 wrote to memory of 2532 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 30 PID 868 wrote to memory of 2532 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 30 PID 868 wrote to memory of 2532 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 30 PID 868 wrote to memory of 2532 868 8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe 30 PID 2532 wrote to memory of 2148 2532 csrssys.exe 31 PID 2532 wrote to memory of 2148 2532 csrssys.exe 31 PID 2532 wrote to memory of 2148 2532 csrssys.exe 31 PID 2532 wrote to memory of 2148 2532 csrssys.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\8e261b67fcd36b84bbf35112caa67f24_mafia_nionspy_JC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"3⤵
- Executes dropped EXE
PID:2148
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0
-
Filesize
344KB
MD57c96ff234219e359660d2ba8da89bb00
SHA124a56a9220b1d83a9654369145a8d99c14cffd11
SHA256768fae7000523bb355dd16dd4416921b255e58dea1858df3e3b3a59dcaccb502
SHA512854d327d5e9c3f26257acb5159936852b70566dc3f4286df9980094b0a391954fea7e8ae3cff4aef65b3cc4ebca00d5448b9a1eb0320e8e3c8a302ef338852f0