Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe
-
Size
327KB
-
MD5
d7aaf1d82a649f0cd27b8087891bd116
-
SHA1
a1d59116e1776f566d3643c3fbe8e9ea68742caa
-
SHA256
8d22c3bc1058aa1f26a82467de5337f182a8bc69f0328918edf5f6afd3a59704
-
SHA512
c42dd63f35c276577317cc9efbc64ce1d0cc0506a63be2c2f482f0e6071c3613bf979edee427f44c28f81b67e71c2bdee40baa50aa5da6c6837624b80754d69a
-
SSDEEP
6144:62+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:62TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2344 taskhostsys.exe 1208 taskhostsys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\Content-Type = "application/x-msdownload" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\DefaultIcon d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\runas d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\ = "jitc" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\open d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\runas\command d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\Content-Type = "application/x-msdownload" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\taskhostsys.exe\" /START \"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\DefaultIcon\ = "%1" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\open\command d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\shell\runas\command\ = "\"%1\" %*" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\.exe\shell\runas\command d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\ = "Application" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\jitc\DefaultIcon\ = "%1" d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2344 taskhostsys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3200 wrote to memory of 2344 3200 d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe 82 PID 3200 wrote to memory of 2344 3200 d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe 82 PID 3200 wrote to memory of 2344 3200 d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe 82 PID 2344 wrote to memory of 1208 2344 taskhostsys.exe 83 PID 2344 wrote to memory of 1208 2344 taskhostsys.exe 83 PID 2344 wrote to memory of 1208 2344 taskhostsys.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\d7aaf1d82a649f0cd27b8087891bd116_mafia_nionspy_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\taskhostsys.exe"3⤵
- Executes dropped EXE
PID:1208
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD56a320514f095402e741757897d85aa70
SHA1c0b7b33f2ae794e0c316ca38579daf543a47638e
SHA2564dceec36040fa96e15db5b03d74a4e1421cc63c0e98050de304f21bc27b4d04a
SHA512a802fcf63bf5c2614646583de24cb67c4ae0754c575444bee8e7c3a9de0973f507c92e8ee03e40b6b412a99ddcd563e6e81273b2fcf7c1d416363fe695bdbe28
-
Filesize
327KB
MD56a320514f095402e741757897d85aa70
SHA1c0b7b33f2ae794e0c316ca38579daf543a47638e
SHA2564dceec36040fa96e15db5b03d74a4e1421cc63c0e98050de304f21bc27b4d04a
SHA512a802fcf63bf5c2614646583de24cb67c4ae0754c575444bee8e7c3a9de0973f507c92e8ee03e40b6b412a99ddcd563e6e81273b2fcf7c1d416363fe695bdbe28
-
Filesize
327KB
MD56a320514f095402e741757897d85aa70
SHA1c0b7b33f2ae794e0c316ca38579daf543a47638e
SHA2564dceec36040fa96e15db5b03d74a4e1421cc63c0e98050de304f21bc27b4d04a
SHA512a802fcf63bf5c2614646583de24cb67c4ae0754c575444bee8e7c3a9de0973f507c92e8ee03e40b6b412a99ddcd563e6e81273b2fcf7c1d416363fe695bdbe28
-
Filesize
327KB
MD56a320514f095402e741757897d85aa70
SHA1c0b7b33f2ae794e0c316ca38579daf543a47638e
SHA2564dceec36040fa96e15db5b03d74a4e1421cc63c0e98050de304f21bc27b4d04a
SHA512a802fcf63bf5c2614646583de24cb67c4ae0754c575444bee8e7c3a9de0973f507c92e8ee03e40b6b412a99ddcd563e6e81273b2fcf7c1d416363fe695bdbe28