Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe
-
Size
327KB
-
MD5
45a0789b3b248196560d2dfb9b778ed3
-
SHA1
89ad62e9f4e8cb5872e74a3488d8dac4236f7ed7
-
SHA256
d9de72d39ce82b5c6950cc62dfc12970ab47b7e94a679f999f213abf4218bf3c
-
SHA512
0de6461bddad1a91631c80a6f14e6403c45eff8727376f537ebd743b5104f0b886367b3a055816edfb8f0ebc3ab69b0488d8ecd7b838bb8eeb44548f7ca514c1
-
SSDEEP
6144:p2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:p2TFafJiHCWBWPMjVWrXf1v
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2560 SearchIndexerDB.exe 2500 SearchIndexerDB.exe -
Loads dropped DLL 4 IoCs
pid Process 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 2560 SearchIndexerDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\Content-Type = "application/x-msdownload" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\open 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\ = "cmos" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\DefaultIcon\ = "%1" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\ = "Application" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\DefaultIcon 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\DefaultIcon 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\runas\command 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\open\command 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\runas 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*" 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.exe\shell\open 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2560 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1764 wrote to memory of 2560 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 2 PID 1764 wrote to memory of 2560 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 2 PID 1764 wrote to memory of 2560 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 2 PID 1764 wrote to memory of 2560 1764 2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe 2 PID 2560 wrote to memory of 2500 2560 SearchIndexerDB.exe 1 PID 2560 wrote to memory of 2500 2560 SearchIndexerDB.exe 1 PID 2560 wrote to memory of 2500 2560 SearchIndexerDB.exe 1 PID 2560 wrote to memory of 2500 2560 SearchIndexerDB.exe 1
Processes
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"1⤵
- Executes dropped EXE
PID:2500
-
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_45a0789b3b248196560d2dfb9b778ed3_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD5c2bbe3d0055e75ec15d2c0d8ca840a15
SHA1b6ef12db196e7ed3e2285dab154e2c90bb5a1a05
SHA256e898c7f2a67120452e11d02b2a7341db6e0e8230de8c1baca8e339469b3eff0e
SHA5120321f87419a538f630739e1c72fe5b96c29d276ca64f6741d7407a4e5c3cabbf9fe7af8612c45600dbba4d80e27b3a4a1b268663e394c952655c54a7d3e7ea01