Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-01-10...py.exe

windows7-x64

7

2024-01-10...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    155s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 05:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-10_e4e53ca8492178e860cd9da16cd38b9e_mafia_nionspy.exe

  • Size

    288KB

  • MD5

    e4e53ca8492178e860cd9da16cd38b9e

  • SHA1

    f1615e91060a996ba13fb3670d8d6238b48d473d

  • SHA256

    f01ac57d8b45b7495cba520e24fe0972184f26c925708ade05e940b29dec0b52

  • SHA512

    717ca292f1d6937b845343dfc3c6141c4e89edf38984a6f28db11f189dc6fd797a6117b3314b107579b036bdfc6c43e1f03d88bd905a305afa77c2dc3e3734d2

  • SSDEEP

    6144:BQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:BQMyfmNFHfnWfhLZVHmOog

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-10_e4e53ca8492178e860cd9da16cd38b9e_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10_e4e53ca8492178e860cd9da16cd38b9e_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3904
  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"
    1⤵
    • Executes dropped EXE
    PID:3752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
    Filesize

    128KB

    MD5

    22f1f438636727ef0d2e7e116ba41621

    SHA1

    98e1f81e2c3629838f504498aeafb30ea27b9237

    SHA256

    5de58e12c97a946e226261456f1bac3daba1c4d576605ce850b85823c75e22ab

    SHA512

    1550f4e8dea4fa91874a3823fcc65bc4584d4a1493084ea0e4a615dd7e16e1cfe37db79c0d97a1e8a073da5180bc3159753b3adcc38a67384417461fdaec28f4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe
    Filesize

    288KB

    MD5

    cb8d8d29a009656129c269fa2734b1f2

    SHA1

    4a1ee2801430627066335dc0ee687aa18969e04f

    SHA256

    809d9a6394a2834f91db04b71ff2cfd5a316c99fbdb713fef16d522fd1195a26

    SHA512

    a325dacef3d575b2bfbb4b95023e8b6de5febfd00a942cbbbfc953801adb9865a99074ee3b63e8e6fc7b6257a778447d79e3c4a268d0250b528747b29f6dd9fd

    Download Submit