Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 00:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe
-
Size
280KB
-
MD5
16ea3085de53cf5b77e6a097f0c06739
-
SHA1
c9a7e031deebd00f5a54a163c9773134eaec0cd4
-
SHA256
63d07145fae1e853d857b0f1c151e1c74224b79246a8feb901145cdb6a95a7bb
-
SHA512
b6a868faa17781916ae45d8d2b858a693e8428bc906bb99227011ea407f6a8a04dfb79dd045ff23758bd8e5d6c74d9abf3584e15f8d0e132be3cfebf1db9c328
-
SSDEEP
6144:JQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:JQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe -
Executes dropped EXE 2 IoCs
pid Process 1540 csrssys.exe 2648 csrssys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrssys.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\runas\command 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\runas 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\Content-Type = "application/x-msdownload" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\DefaultIcon\ = "%1" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\Content-Type = "application/x-msdownload" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\open 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\ = "Application" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\runas\command 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\DefaultIcon\ = "%1" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\open 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\runas 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\runas\command\ = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\DefaultIcon 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\runas\command\ = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\ = "wexplorer" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\shell\open\command 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\open\command 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*" 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\.exe\DefaultIcon 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1540 csrssys.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3992 wrote to memory of 1540 3992 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe 87 PID 3992 wrote to memory of 1540 3992 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe 87 PID 3992 wrote to memory of 1540 3992 2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe 87 PID 1540 wrote to memory of 2648 1540 csrssys.exe 88 PID 1540 wrote to memory of 2648 1540 csrssys.exe 88 PID 1540 wrote to memory of 2648 1540 csrssys.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_16ea3085de53cf5b77e6a097f0c06739_mafia_nionspy.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"3⤵
- Executes dropped EXE
PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5bde37a0d653ab4e50314c215204ef757
SHA1eedf7cff23c1e60a9784f19a7c5363638de03964
SHA25683f6d160b6557b9ea7ad31108c06e70c998d57cd811960fa5676d2d9efdc0b5a
SHA51231c61230a1475dc9ac1d91fecd79b378a96b19f72a3b17a54f30bcff7587bbbc4c8b6ad711ada25610abe7e1a27bbf2e15b365d0196fc273630682c370e1b899