Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-05-03...py.exe

windows7-x64

7

2024-05-03...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 04:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-03_d9b6f44dc1badca21a3a5945c5218252_mafia_nionspy.exe

  • Size

    344KB

  • MD5

    d9b6f44dc1badca21a3a5945c5218252

  • SHA1

    0def5b228d636e0a839c51883b7077c7eb4cf9eb

  • SHA256

    12ac675257174206a70236522813f851ea0b8c194ffdd90e12ebb2ed8e5ed8d7

  • SHA512

    69f46751d9670d5adc7eff6382e4b98d1b314c2b7c0a2c0f708b31adafc25ed21de32883e69c4df8cd9a1d76eccacc670a1aa8b50064f3f870f33e2d97236967

  • SSDEEP

    6144:STz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:STBPFV0RyWl3h2E+7pYm0

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_d9b6f44dc1badca21a3a5945c5218252_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_d9b6f44dc1badca21a3a5945c5218252_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe"
        3⤵
        • Executes dropped EXE
        PID:3084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\csrssys.exe
    Filesize

    344KB

    MD5

    bad0feb32d4a17699aad2eaf305ab916

    SHA1

    a49964ea7c9e29f6781a363812ffc0f333f57af4

    SHA256

    1e3002b852cce9d1276161a898d8d775f299e11a5ef2383699de1ab5aef096f2

    SHA512

    6585bb685ac494a9eff3ae5fac74d83630242f30f6218ec659b4de1bb9ecdd5a2ac958debe646adeca1d96cf1c93b425d8858b8f3d22f638e107c3ca87a978c7

    Download Submit