Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 18:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe
-
Size
280KB
-
MD5
c6d1128dd6f058e2149071226622f5f5
-
SHA1
dfb3452f638daa225640079bb70661ad38950b21
-
SHA256
b416fb739bf17690905913c5c3ccef8be721c7b001ecafe1c680a478e2dac546
-
SHA512
604e4bcb30d9cbd8de5f0653e0aea1923166b663a756dc91580064215ea18e73ac10da47aafda199f899e23aa918b2cb157c2ffd5810041c44a571b603b097a6
-
SSDEEP
6144:NTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:NTBPFV0RyWl3h2E+7pl
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 5052 winit32.exe 5012 winit32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\ = "Application" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\winit32.exe\" /START \"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\runas 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\open 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\ = "ntdriver" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\winit32.exe\" /START \"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\runas\command 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\DefaultIcon 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\open 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\DefaultIcon 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\open\command 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\runas\command 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\runas\command\ = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\.exe\shell\open\command 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\DefaultIcon\ = "%1" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\Content-Type = "application/x-msdownload" 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\ntdriver\shell\runas 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 5052 winit32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1688 wrote to memory of 5052 1688 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe 84 PID 1688 wrote to memory of 5052 1688 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe 84 PID 1688 wrote to memory of 5052 1688 2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe 84 PID 5052 wrote to memory of 5012 5052 winit32.exe 85 PID 5052 wrote to memory of 5012 5052 winit32.exe 85 PID 5052 wrote to memory of 5012 5052 winit32.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_c6d1128dd6f058e2149071226622f5f5_mafia_nionspy.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\winit32.exe"3⤵
- Executes dropped EXE
PID:5012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD50bbfe9ee4dde3706f269cd42bfc1e13f
SHA179b86b45ae03abcb807c70dcd4822ccc93168dd2
SHA256e070ab2055af93efbcf82d64e91fc59fd342c85d40f398f355ed335e25b9adfa
SHA5124af2f825addaff99c0e1dfc7be3da39177aaec4d38c1cce0e01802e89885e31dbdc388d7565bf1fc5826961a7c4290b24b1dea075b6711a18a38eb9550ea0db4