Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe
-
Size
280KB
-
MD5
53939266a0cb46d6a7f417fa6341b9f0
-
SHA1
44c801b1fe89aa717255940cfc4f52b49767609c
-
SHA256
ad864cc71479542a1d634c036620ac8efa13e48f0f69d79e0acb325e5e8fd442
-
SHA512
d840275835b53734a0340352d84bd15f49da1a796e6cdde435e6cd612fc142664338c6f37fecca04e3b433b3173bb71e04f101dd77d96a48795acaf02d862386
-
SSDEEP
6144:sTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:sTBPFV0RyWl3h2E+7pl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3024 wlogon32.exe 2652 wlogon32.exe -
Loads dropped DLL 4 IoCs
pid Process 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 3024 wlogon32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\runas\command 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\DefaultIcon\ = "%1" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\wlogon32.exe\" /START \"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\runas 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "haldriver" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\DefaultIcon 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_x86_64\\wlogon32.exe\" /START \"%1\" %*" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\ = "Application" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload" 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\open\command 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\haldriver\shell\open 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3024 wlogon32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3024 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 28 PID 2872 wrote to memory of 3024 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 28 PID 2872 wrote to memory of 3024 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 28 PID 2872 wrote to memory of 3024 2872 2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe 28 PID 3024 wrote to memory of 2652 3024 wlogon32.exe 29 PID 3024 wrote to memory of 2652 3024 wlogon32.exe 29 PID 3024 wrote to memory of 2652 3024 wlogon32.exe 29 PID 3024 wrote to memory of 2652 3024 wlogon32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_53939266a0cb46d6a7f417fa6341b9f0_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_x86_64\wlogon32.exe"3⤵
- Executes dropped EXE
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5f145064d1b2589abf742b9133b15d07f
SHA105db6e3b5ec69afb0ab316035893970eac829d1b
SHA256993a1a90de3fe3b2ca2e9d66e0b764befe7821805be417d7073723b05cf31a02
SHA512bc6c2ba48bc30e090091bf4aadf9c120376d78b2f3d2110d3c3942ea39feb21fa51642e7d9a9c79e479aede985075ebab91b3d97dc39696f83b8325ca3e2ab1c