Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe
-
Size
327KB
-
MD5
28d0751662e13a00f88f021f3d1916df
-
SHA1
ae455b75fa3b7283f4e3c905df7a819e93811450
-
SHA256
bb0938af191ac83a0b0d891a6f72f890ab14ee039e9e581ca3b6bc62f92f161d
-
SHA512
3b9e47f70c5b0f633a389813faf1c1e25205e3c02e8469c8d1706387af0b280f8ad68bd51ca7a863fce6545857aaebb6f9a4ad011d33f34858973432953f55bc
-
SSDEEP
6144:l2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:l2TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 3644 wlogon32.exe 1608 wlogon32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\open 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\DefaultIcon 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\DefaultIcon\ = "%1" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\Content-Type = "application/x-msdownload" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\open\command 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\ = "Application" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\wlogon32.exe\" /START \"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\DefaultIcon 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\open 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\runas\command 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\runas 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\open\command 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\ = "haldriver" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\runas\command 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\runas 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\haldriver\shell\runas\command\ = "\"%1\" %*" 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3644 wlogon32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2108 wrote to memory of 3644 2108 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe 89 PID 2108 wrote to memory of 3644 2108 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe 89 PID 2108 wrote to memory of 3644 2108 2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe 89 PID 3644 wrote to memory of 1608 3644 wlogon32.exe 90 PID 3644 wrote to memory of 1608 3644 wlogon32.exe 90 PID 3644 wrote to memory of 1608 3644 wlogon32.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_28d0751662e13a00f88f021f3d1916df_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\wlogon32.exe"3⤵
- Executes dropped EXE
PID:1608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD573a2f36f47f9c9c586771b66f60ed456
SHA130e26fcf475cdbf2c31458717985eb3642147fbc
SHA256fe536a916aa5c642ccc6552967523ad6af9869a94b2c49f91ae7384ac936b088
SHA512e6492978743958727d71ddfac4975b0adca1686d713f982b6bed6a5ba52e223974b9e5507c1c4b5b7a945c6941d42ea8ae27891998a83a9cda5b9124ebbf18e9