Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
02/09/2023, 19:24
General
-
Target
2023-08-22_75d6c1f8dd903351c6dac7cc7022123f_mafia_nionspy_JC.exe
-
Size
328KB
-
MD5
75d6c1f8dd903351c6dac7cc7022123f
-
SHA1
c097726cabd8085ba216919c34b8cfcf87d7dc9d
-
SHA256
d79c77af7dd10071eae23bf47cb4c1508d07aa65c4f28f5f1341cd042f2dd5cc
-
SHA512
2b8ed2d8a2701110b7e8fe08383d1f64cca1850addbe50b38e78ef40ce0e1caad07cec967f9f32daa068ba414702d2ab28fdcc9bfcdf9eb76ce95a2b06ceca20
-
SSDEEP
6144:b2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:b2TFafJiHCWBWPMjVWrXf1v
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_75d6c1f8dd903351c6dac7cc7022123f_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_75d6c1f8dd903351c6dac7cc7022123f_mafia_nionspy_JC.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\csrssys.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD50ab7458aff18148a9992fb4b54d8147a
SHA12e0dc827ba38833a39af3ec9971f04226e39a50e
SHA256d2afaeb2bf3d0185284d1603720510e423ac9e30e1c5f6a545a348c03c5c12fc
SHA5122ee76250302671aaf66fba47249c90ef34b64191156042ae6c33b001aa6960bbc9295ac1188b48732cffa8cc732d05f6d34d383bde47359007e9400d107f16b7
-
Filesize
328KB
MD50ab7458aff18148a9992fb4b54d8147a
SHA12e0dc827ba38833a39af3ec9971f04226e39a50e
SHA256d2afaeb2bf3d0185284d1603720510e423ac9e30e1c5f6a545a348c03c5c12fc
SHA5122ee76250302671aaf66fba47249c90ef34b64191156042ae6c33b001aa6960bbc9295ac1188b48732cffa8cc732d05f6d34d383bde47359007e9400d107f16b7
-
Filesize
328KB
MD50ab7458aff18148a9992fb4b54d8147a
SHA12e0dc827ba38833a39af3ec9971f04226e39a50e
SHA256d2afaeb2bf3d0185284d1603720510e423ac9e30e1c5f6a545a348c03c5c12fc
SHA5122ee76250302671aaf66fba47249c90ef34b64191156042ae6c33b001aa6960bbc9295ac1188b48732cffa8cc732d05f6d34d383bde47359007e9400d107f16b7
-
Filesize
328KB
MD50ab7458aff18148a9992fb4b54d8147a
SHA12e0dc827ba38833a39af3ec9971f04226e39a50e
SHA256d2afaeb2bf3d0185284d1603720510e423ac9e30e1c5f6a545a348c03c5c12fc
SHA5122ee76250302671aaf66fba47249c90ef34b64191156042ae6c33b001aa6960bbc9295ac1188b48732cffa8cc732d05f6d34d383bde47359007e9400d107f16b7