Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe
-
Size
328KB
-
MD5
0c609311f81d342d58051239819f74b6
-
SHA1
5da0fb997c35276b1d74bb63bca84a20abbe1997
-
SHA256
e8bf2ea8e88039b5e5a51cf96e38ebb1b62109d1856424bb1381fe9fdcf91a3a
-
SHA512
fe17df2c5abc7cb3c4f84e58f598fa3ff29f49433555a59c204f03d05898c49cfcc764f419a36ca74b206a6b87388aaf7a02221f9d7ad4a6e09fb21960269e76
-
SSDEEP
6144:G2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:G2TFafJiHCWBWPMjVWrXf1v
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2628 winit32.exe 2044 winit32.exe -
Loads dropped DLL 4 IoCs
pid Process 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 2628 winit32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "ntdriver" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\DefaultIcon 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\ = "Application" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\runas 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\winit32.exe\" /START \"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\DefaultIcon\ = "%1" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\ntdriver\shell\open 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\winit32.exe\" /START \"%1\" %*" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2628 winit32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2628 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 28 PID 2920 wrote to memory of 2628 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 28 PID 2920 wrote to memory of 2628 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 28 PID 2920 wrote to memory of 2628 2920 2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe 28 PID 2628 wrote to memory of 2044 2628 winit32.exe 29 PID 2628 wrote to memory of 2044 2628 winit32.exe 29 PID 2628 wrote to memory of 2044 2628 winit32.exe 29 PID 2628 wrote to memory of 2044 2628 winit32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_0c609311f81d342d58051239819f74b6_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\winit32.exe"3⤵
- Executes dropped EXE
PID:2044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD56836d3acba6a99c98e709e6e6e401f5b
SHA1249345bb0d2b05a86cf3ac8bf6bac178aab6ab3a
SHA256f635f14ef36ac27be1c6b35d6df4bb8c9f959cfe8a34b27e788f48e3dbc457d3
SHA512a5d000ef44ae3c3341232f25dd09ec998cb5b77175881daabb5c0af852660bfdbde29845b371448f09c34cbac1f44f05170469cf6348ed61b2b9b2f2a0373013