Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe
-
Size
280KB
-
MD5
c8a4ec52a4ff355cc7c83f03d3dc60b1
-
SHA1
319da3b07c14d8b653985592d9015abfb9f90835
-
SHA256
34c47d04bf21e397b271abca355266356c90c743d842c4941c38f0bc21c00fc2
-
SHA512
13ee3fea38f68d99de992f06fa391eee544c1ca109c3a88c30e4949a3c43963ec16b336a9c95063de560d7bc7ed763818443c30833d9a088e8435c8e3609899f
-
SSDEEP
6144:5Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:5QMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2708 winit32.exe 2464 winit32.exe -
Loads dropped DLL 3 IoCs
pid Process 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\runas 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\winit32.exe\" /START \"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\winit32.exe\" /START \"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\DefaultIcon 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\open 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\runas\command\ = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\Content-Type = "application/x-msdownload" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\DefaultIcon 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\open 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\DefaultIcon\ = "%1" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\open\command 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\shell\runas\command 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\ = "Application" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\ntdriver\shell\runas\command 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.exe\ = "ntdriver" 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2708 winit32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2708 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 28 PID 1640 wrote to memory of 2708 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 28 PID 1640 wrote to memory of 2708 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 28 PID 1640 wrote to memory of 2708 1640 2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe 28 PID 2708 wrote to memory of 2464 2708 winit32.exe 29 PID 2708 wrote to memory of 2464 2708 winit32.exe 29 PID 2708 wrote to memory of 2464 2708 winit32.exe 29 PID 2708 wrote to memory of 2464 2708 winit32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_c8a4ec52a4ff355cc7c83f03d3dc60b1_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\winit32.exe"3⤵
- Executes dropped EXE
PID:2464
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD52474776e2bda6661c568f472517ee0e8
SHA1cb319c2110220563589ae050423e4fab32609263
SHA256293e3d51625a79538736b526526c8096142f7b5438dec3ab26ef31ce07fc760e
SHA512ebfc3669420946a1985f40317fe690a897affb7bb723a04c0dcfae59e23bb280019a37ce136675008ebfdf173f5a30601ca434cc0291919ee28024de918bab3c