Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe
-
Size
327KB
-
MD5
4ba5800cf09bd91c4a18512fefdb60eb
-
SHA1
b820c7f57cc7e4728f91cc3a9c19c8163a44356f
-
SHA256
c2a1526dd574293fc7d7ea835b9a14a53fbc91df3b18bf7e652bb668677c7642
-
SHA512
4a6557de8d0316ad1136b89d6c368e7dc3faf82e63bdece25bc5d838e139205a808e6c7cdb7759b41565a9f2235f7b6a611244fd0637436f7c3371e3b6cab32f
-
SSDEEP
6144:82+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:82TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2696 SearchIndexerDB.exe 2504 SearchIndexerDB.exe -
Loads dropped DLL 3 IoCs
pid Process 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\runas\command NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\ = "Application" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\DefaultIcon NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\open\command NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\runas\command NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\DefaultIcon\ = "%1" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\open\command NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\Content-Type = "application/x-msdownload" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\runas NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\ = "jitc" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\open NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\DefaultIcon\ = "%1" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\runas NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\DefaultIcon NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\open NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*" NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2696 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2696 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 28 PID 2296 wrote to memory of 2696 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 28 PID 2296 wrote to memory of 2696 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 28 PID 2296 wrote to memory of 2696 2296 NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe 28 PID 2696 wrote to memory of 2504 2696 SearchIndexerDB.exe 29 PID 2696 wrote to memory of 2504 2696 SearchIndexerDB.exe 29 PID 2696 wrote to memory of 2504 2696 SearchIndexerDB.exe 29 PID 2696 wrote to memory of 2504 2696 SearchIndexerDB.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_4ba5800cf09bd91c4a18512fefdb60eb_mafia_nionspy_JC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"3⤵
- Executes dropped EXE
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1
-
Filesize
327KB
MD58b046e73bd6dda7465e1e98093a12a08
SHA1b4088f4c1f479b7142500fb9522c18c6e980be03
SHA2569b7d980d985ed7246b827b7211807a3873f47dd2350026347fae530ddd5ae493
SHA512b6949e4147b873e64f3669360e2355c4ee50f2e349f7522d74eeb6c555ba1f87ba0665e44b3580efa77cf3cae991700452a2262792385ad21c5ed2dcb504d6b1