Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe
-
Size
274KB
-
MD5
a5fde98cae9a1bdaf178944db36f2dac
-
SHA1
fc704975fc96b873ba5e7e9eb8154c8dfbe1b26a
-
SHA256
43db7419f70eac0532b1645636810f0f564efbd8cff1c88f24c4c1b8cc7b4aaa
-
SHA512
417aa823d6cc1e6062513f54d7d033b98ff5c9bf9dc6b35f80ed82947c53db3fbf68cab645ffbe9a76505a477d91bf8e94c4990c7c0b5a9a83b3e506d3722cef
-
SSDEEP
6144:YYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:YYvEbrUjp3SpWggd3JBPlPDIQ3g
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 4064 lsassys.exe 2880 lsassys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\runas\command 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\DefaultIcon 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\lsassys.exe\" /START \"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\open 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\lsassys.exe\" /START \"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\ = "Application" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\runas 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\Content-Type = "application/x-msdownload" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\runas\command 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\ = "halnt" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\open\command 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\DefaultIcon 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\open 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\runas\command\ = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\DefaultIcon\ = "%1" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\open\command 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\halnt\shell\runas 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4064 lsassys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2848 wrote to memory of 4064 2848 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe 83 PID 2848 wrote to memory of 4064 2848 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe 83 PID 2848 wrote to memory of 4064 2848 2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe 83 PID 4064 wrote to memory of 2880 4064 lsassys.exe 84 PID 4064 wrote to memory of 2880 4064 lsassys.exe 84 PID 4064 wrote to memory of 2880 4064 lsassys.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_a5fde98cae9a1bdaf178944db36f2dac_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"3⤵
- Executes dropped EXE
PID:2880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274KB
MD54a2c00ae4d56f63a1ce7c1e02f12c260
SHA1377eb2d67e5758b8cfb8ff201e434e9a662e9db7
SHA2565ff04bef89d344d6e41f556b34cbed0bf630772014372fba3dfea559e7994428
SHA512605386a163a49e8b98a8cff920e92e2d35ae081247ad33222169ae0fdbfaabf2be763c6c94007359a5d78185deb1d337c03ea138ad8ad2ad61f1b04cec6b28a1