Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 13:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe
-
Size
344KB
-
MD5
961c69a6fc780beec70d9bae1aab4498
-
SHA1
5ea26c67284c8c557127e6dfd4bedcb59f069810
-
SHA256
a026c256a37e87eb6b5687ec32c51ee209701b30562ecf3d28a724aaf9f15aa0
-
SHA512
4e195f5106c791453e3ece8f79774f836a2696c83681db2e23cd2cee8e7242056a33742fe18c522c9c09a1dbdb64e559b57b67810d5abd7414e400aeb536d286
-
SSDEEP
6144:7Tz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:7TBPFV0RyWl3h2E+7pYm0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 2988 dwmsys.exe 3904 dwmsys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\open 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\runas 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\runas\command 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\ = "systemui" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\open 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\runas\command 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\Content-Type = "application/x-msdownload" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\DefaultIcon\ = "%1" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\dwmsys.exe\" /START \"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\DefaultIcon 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\DefaultIcon 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\runas 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\runas\command\ = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\ = "Application" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\systemui\shell\open\command 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\open\command 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\dwmsys.exe\" /START \"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2988 dwmsys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3856 wrote to memory of 2988 3856 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe 87 PID 3856 wrote to memory of 2988 3856 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe 87 PID 3856 wrote to memory of 2988 3856 2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe 87 PID 2988 wrote to memory of 3904 2988 dwmsys.exe 88 PID 2988 wrote to memory of 3904 2988 dwmsys.exe 88 PID 2988 wrote to memory of 3904 2988 dwmsys.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_961c69a6fc780beec70d9bae1aab4498_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\dwmsys.exe"3⤵
- Executes dropped EXE
PID:3904
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5969bc71ce9c11fc7e1eb0b973d8c592e
SHA15db58d5b1617b123e3831fbcf397263f25bdc7d1
SHA256c720e868a2e6184738296daf57d1e1dda064582348017f3ba1dfa5e5da5b4a02
SHA512ad8e5038fe1a38ef066b8ed166323452b4d0a6c1722424bf3b05289fda7498d14a0a80456b762349b6d1bb67272abd874b05c2dfa02526f5da5bb13e854a7cb5