Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe
-
Size
279KB
-
MD5
d93a45bb46ae728f10fd9604f359fec0
-
SHA1
af75913915e538af0841cf745233b37a76461c01
-
SHA256
4d60296d7294a927fa50f6137d2d85da83c271b773b5bdbb5a5c7521f311d196
-
SHA512
0b5ca931e3bff0fa2a0f012758e179f00266dc1c005848a2121041ecf8852ed70418213e87242b4877fe180772e44fa3aa302fb1cc78df9a6c0b4b21bcd80fbe
-
SSDEEP
6144:OTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDb:OTBPFV0RyWl3h2E+7pY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4476 dwmsys.exe 1820 dwmsys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\dwmsys.exe\" /START \"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\runas\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\Content-Type = "application/x-msdownload" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\open\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\runas\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\dwmsys.exe\" /START \"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\runas d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\DefaultIcon\ = "%1" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\DefaultIcon\ = "%1" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\ = "Application" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\Content-Type = "application/x-msdownload" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\DefaultIcon d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\DefaultIcon d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\open\command d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\open d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\runas d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\systemui\shell\runas\command\ = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\ = "systemui" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\open d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4476 dwmsys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4476 3648 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 82 PID 3648 wrote to memory of 4476 3648 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 82 PID 3648 wrote to memory of 4476 3648 d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe 82 PID 4476 wrote to memory of 1820 4476 dwmsys.exe 83 PID 4476 wrote to memory of 1820 4476 dwmsys.exe 83 PID 4476 wrote to memory of 1820 4476 dwmsys.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\d93a45bb46ae728f10fd9604f359fec0_mafia_nionspy_JC.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\dwmsys.exe"3⤵
- Executes dropped EXE
PID:1820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279KB
MD5a23e48a547049ef385c41f074a4bb8a1
SHA1a4ab9ea7058517def32b3598189e1084af7e800c
SHA256f1c5b5b7a3c6411f6f02beeccd6b90040df996dec77935e955576efa23c4b8d3
SHA512c5fd3152f5094f67df2c2bf583b12f4d82c108779b0fcc371ff5960d87f3f515fa45de85720e48b226686e4d110c8303700b37f5779327b2119696f4f0ec4451
-
Filesize
279KB
MD5a23e48a547049ef385c41f074a4bb8a1
SHA1a4ab9ea7058517def32b3598189e1084af7e800c
SHA256f1c5b5b7a3c6411f6f02beeccd6b90040df996dec77935e955576efa23c4b8d3
SHA512c5fd3152f5094f67df2c2bf583b12f4d82c108779b0fcc371ff5960d87f3f515fa45de85720e48b226686e4d110c8303700b37f5779327b2119696f4f0ec4451
-
Filesize
279KB
MD5a23e48a547049ef385c41f074a4bb8a1
SHA1a4ab9ea7058517def32b3598189e1084af7e800c
SHA256f1c5b5b7a3c6411f6f02beeccd6b90040df996dec77935e955576efa23c4b8d3
SHA512c5fd3152f5094f67df2c2bf583b12f4d82c108779b0fcc371ff5960d87f3f515fa45de85720e48b226686e4d110c8303700b37f5779327b2119696f4f0ec4451
-
Filesize
279KB
MD5a23e48a547049ef385c41f074a4bb8a1
SHA1a4ab9ea7058517def32b3598189e1084af7e800c
SHA256f1c5b5b7a3c6411f6f02beeccd6b90040df996dec77935e955576efa23c4b8d3
SHA512c5fd3152f5094f67df2c2bf583b12f4d82c108779b0fcc371ff5960d87f3f515fa45de85720e48b226686e4d110c8303700b37f5779327b2119696f4f0ec4451