Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-05-23...py.exe

windows7-x64

7

2024-05-23...py.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 14:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-23_8994957803c01c70192703866be45684_mafia_nionspy.exe

  • Size

    274KB

  • MD5

    8994957803c01c70192703866be45684

  • SHA1

    351e996979b682433c296c28d1e5d7ec17586849

  • SHA256

    b5f8c367e53bf8b1d0b1fdb464fe4358c5bf42f081deea8452f7b9e6c1f049f2

  • SHA512

    2ab9ddff4033fcfbedeb54dcc0ecc5d89c46297c3c5588968651984b031e56ed5adf7f3ea6eed70eef2bd0793f67ed81fed9d6bd713f814b401ae968ab243ea8

  • SSDEEP

    6144:jYvZ6brUj+bvqHXSpWr2Kqz83Oad3Jg4PlPDIQ+KLzDDg:jYvEbrUjp3SpWggd3JBPlPDIQ3g

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-23_8994957803c01c70192703866be45684_mafia_nionspy.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-23_8994957803c01c70192703866be45684_mafia_nionspy.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe"
        3⤵
        • Executes dropped EXE
        PID:1832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\lsassys.exe
    Filesize

    274KB

    MD5

    a726508b4ffd210df68287933100bb94

    SHA1

    9fe91a396d35fa13535a31f70d2509c2431b3235

    SHA256

    4fd885c0139fd504bd708e76fe15873cb98a59fa70daa99c20e6f6bb4b77cd1b

    SHA512

    b81e22aec3a167c434bca34b684a2f7110dcc108b3e52090f4575b0a3924ebcd9235e4ed9a600b4230eff069f08e591fbe30ad3a21927818c7608d5fcf279c66

    Download Submit