Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
-
Size
279KB
-
MD5
d93a45bb46ae728f10fd9604f359fec0
-
SHA1
af75913915e538af0841cf745233b37a76461c01
-
SHA256
4d60296d7294a927fa50f6137d2d85da83c271b773b5bdbb5a5c7521f311d196
-
SHA512
0b5ca931e3bff0fa2a0f012758e179f00266dc1c005848a2121041ecf8852ed70418213e87242b4877fe180772e44fa3aa302fb1cc78df9a6c0b4b21bcd80fbe
-
SSDEEP
6144:OTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDb:OTBPFV0RyWl3h2E+7pY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 888 sidebar2.exe 2648 sidebar2.exe -
Loads dropped DLL 3 IoCs
pid Process 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\sidebar2.exe\" /START \"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\open\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\runas d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\sidebar2.exe\" /START \"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon\ = "%1" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\runas\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\runas\command\ = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\open d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\DefaultIcon\ = "%1" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\runas\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\ = "prochost" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\Content-Type = "application/x-msdownload" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\DefaultIcon d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell\open\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\ = "Application" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\prochost\shell d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 888 sidebar2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1952 wrote to memory of 888 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 28 PID 1952 wrote to memory of 888 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 28 PID 1952 wrote to memory of 888 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 28 PID 1952 wrote to memory of 888 1952 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 28 PID 888 wrote to memory of 2648 888 sidebar2.exe 29 PID 888 wrote to memory of 2648 888 sidebar2.exe 29 PID 888 wrote to memory of 2648 888 sidebar2.exe 29 PID 888 wrote to memory of 2648 888 sidebar2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\sidebar2.exe"3⤵
- Executes dropped EXE
PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72
-
Filesize
279KB
MD563b705796808d50b5bc9120b22c2d990
SHA12a49add6edb2c09b277bc6afa29277eef5b77f18
SHA2569186fe0b8b2dbb42fa4ebc2faabbffbdd8924973a0aea6fd17bac791dbebed0d
SHA5129976574917b8ef12ebd4aaba0d6ebfad69cb7b2c2c4200b6adf6936281dae2492f710748b53e802159c50c111edb648eda8bf0a294e3e708e924908c613f5b72