Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe
-
Size
280KB
-
MD5
8e97205ff2b4c29bc253a8cb08b1858b
-
SHA1
d2413d69ef34002232f2ad23fd6e2b2c19075a98
-
SHA256
67200d1e8209bf9bfd567af74037956155faabf59d777588a03b879e706cefa4
-
SHA512
6a19cd24ccb67fe7ebbbf68e0efde5ef2225884373bc98ca358c9d7edb8cce2d814f28a028781a8002e98e201237bd980e97b5439f39063127f59aa3d0545ff8
-
SSDEEP
6144:0Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:0QMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2664 SearchIndexerDB.exe 2640 SearchIndexerDB.exe -
Loads dropped DLL 4 IoCs
pid Process 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 2664 SearchIndexerDB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchIndexerDB.exe -
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\runas 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\DefaultIcon 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\ = "Application" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\Content-Type = "application/x-msdownload" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\DefaultIcon 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\DefaultIcon\ = "%1" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\DefaultIcon\ = "%1" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\open\command 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\runas\command 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos\shell\open 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\cmos 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\ = "cmos" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SView\\SearchIndexerDB.exe\" /START \"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.exe\shell\runas 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2664 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2664 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 30 PID 2964 wrote to memory of 2664 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 30 PID 2964 wrote to memory of 2664 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 30 PID 2964 wrote to memory of 2664 2964 2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe 30 PID 2664 wrote to memory of 2640 2664 SearchIndexerDB.exe 31 PID 2664 wrote to memory of 2640 2664 SearchIndexerDB.exe 31 PID 2664 wrote to memory of 2640 2664 SearchIndexerDB.exe 31 PID 2664 wrote to memory of 2640 2664 SearchIndexerDB.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-27_8e97205ff2b4c29bc253a8cb08b1858b_mafia_nionspy.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SView\SearchIndexerDB.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Roaming\Microsoft\SView\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SView\SearchIndexerDB.exe"3⤵
- Executes dropped EXE
PID:2640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5fa95fa1b9cb9a376b21d56a6214863e7
SHA17aab625d0dd64301adfc4348a8f704ff77acda56
SHA25688e47556b54fd5415edc6f3a2ef8850a435ee6f67dc23c6c0b3b015aaabd5d9c
SHA512c672b20f9b3e41199276fb6661a5da002de3434d451369d773b81253071e351f0676d3fe61d76ccb3ad6834c70ded1986cb126450ecb5bae2bf0692f63472a0e