Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-03-08...py.exe

windows7-x64

7

2024-03-08...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 08:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe

  • Size

    280KB

  • MD5

    1d8470c9ff868f50f6d4e887006c8fa7

  • SHA1

    8687cd1581d7ce4eb26272078a3cdd96aed6a50c

  • SHA256

    f0f349cad9369a5bdcf6904def30a898a491a31752a5ec343d069685ab3ac618

  • SHA512

    db13b9a5db8de01b5b1b9584bef974cd0be77597c06a1eb28ad9749cea89c23c1db88906c81fc3a2a97dfc96d3d88ee6d8fb63bbada083a1f7d657dde3e8ce40

  • SSDEEP

    6144:vTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:vTBPFV0RyWl3h2E+7pl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-08_1d8470c9ff868f50f6d4e887006c8fa7_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe"
        3⤵
        • Executes dropped EXE
        PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\lsassys.exe
    Filesize

    280KB

    MD5

    8f5095edf605129d81a79116e7afe23c

    SHA1

    649d907cf0dd564a33ad1eba3bbee3da115ecb83

    SHA256

    50416da8046719f9408e7cc67116a67d7863b5d28f7d99de270ab04f360bb3d6

    SHA512

    dd8cde21a81b8bf6a8be6b7dc18e6f2c8de534224524aaf267f01261896ffdc57face8cf80597beb31664b9f2c72381edb6c49f3f29b702485b3a81384c1f0ed

    Download Submit