Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe
-
Size
280KB
-
MD5
0731bbf90e266a07373107ee7723a7e6
-
SHA1
133e1aae41fb6f0c3a49c482c1aa4edf33624c82
-
SHA256
5c9a0ec78c8bce95b9493e65def6f8d08a7e75e1c4efde25dd044731ffcfc12d
-
SHA512
8755e90abae997de506118afe55ff26bd431e8320fa66adf09bb7e528fab6b5cd91a92cd5219a2643da0a06ad706b9d534f7e6d9dc9cada4d1e7bb8c4591419c
-
SSDEEP
6144:vQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:vQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 2260 SearchIndexerDB.exe 2252 SearchIndexerDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\DefaultIcon 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\runas 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\open\command 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\open 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\XMMC\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\runas\command\ = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\open\command 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\DefaultIcon 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\DefaultIcon\ = "%1" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\open 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\runas\command 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\ = "Application" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\shell\runas 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\jitc\Content-Type = "application/x-msdownload" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\ = "jitc" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\.exe\shell\runas\command 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2260 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1200 wrote to memory of 2260 1200 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe 83 PID 1200 wrote to memory of 2260 1200 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe 83 PID 1200 wrote to memory of 2260 1200 2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe 83 PID 2260 wrote to memory of 2252 2260 SearchIndexerDB.exe 84 PID 2260 wrote to memory of 2252 2260 SearchIndexerDB.exe 84 PID 2260 wrote to memory of 2252 2260 SearchIndexerDB.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_0731bbf90e266a07373107ee7723a7e6_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\XMMC\SearchIndexerDB.exe"3⤵
- Executes dropped EXE
PID:2252
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5fb736e64ff5de5731fa8be5fd650b512
SHA139422dc6c5a6711fd1a2288394139af3ca140ab1
SHA25650a718468b5b4ff2010239456334e7384eb69cb4d86b719a2378a245fe5bc0c0
SHA5126dae55de193cafd18787ce840a293811bf1eb9f6c86f2967621f15964d915810902e82bacafa4476861cd4360b3235b5d926edcc7dbf4141c40f79a878872096