Resubmissions
23-08-2021 16:26
210823-tx5an7s74s 1018-08-2021 20:35
210818-2gkvb49v8e 1022-07-2021 19:24
210722-68c2armfnx 10Analysis
-
max time kernel
104s -
max time network
111s -
platform
windows11_x64 -
resource
win11 -
submitted
23-08-2021 16:26
Static task
static1
Behavioral task
behavioral1
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
-
Size
21KB
-
MD5
4160c35d3c600712b528e8072de1bc58
-
SHA1
12c822103678fed7b928f0202eb7e51714ab3b56
-
SHA256
f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
-
SHA512
f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4148 created 4992 4148 WerFault.exe 79 -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 WaaSMedicAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 WaaSMedicAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 WaaSMedicAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 WaaSMedicAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 sihclient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 sihclient.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\d62540ea7d8b4a9d1958e44f689fb27e\BITCA9E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d62540ea7d8b4a9d1958e44f689fb27e\Windows10.0-KB5004342-x64-NDP48.cab svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab sihclient.exe File opened for modification C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab sihclient.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4608 4992 WerFault.exe 79 -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4608 WerFault.exe 4608 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe Token: SeRestorePrivilege 1052 TiWorker.exe Token: SeSecurityPrivilege 1052 TiWorker.exe Token: SeBackupPrivilege 1052 TiWorker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4148 wrote to memory of 4992 4148 WerFault.exe 79 PID 4148 wrote to memory of 4992 4148 WerFault.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"1⤵PID:4992
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4992 -s 1522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4608
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 4992 -ip 49921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4564
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 681ea2316bbc2a72a0a1da8b81252cab R3q930x020WnyfI9gsy3Ow.0.1.0.3.01⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4568
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 681ea2316bbc2a72a0a1da8b81252cab R3q930x020WnyfI9gsy3Ow.0.1.0.3.01⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1360
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 681ea2316bbc2a72a0a1da8b81252cab R3q930x020WnyfI9gsy3Ow.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:1984
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv R3q930x020WnyfI9gsy3Ow.0.21⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4928