Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-06-2022 14:10
Static task
static1
Behavioral task
behavioral1
Sample
Magniber11.msi
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Magniber11.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Magniber11.msi
-
Size
11.4MB
-
MD5
43db7b2265449e9e7fbe92cf64489312
-
SHA1
d5b15d33a6406c603622f4bf98729f63c71c7933
-
SHA256
b9669bea10051a80e268a97e455404a0f50c310ed92d26965d8b097429c0adcf
-
SHA512
a9751360b4ca881fa2b621832222f74d4482a5295522dc8367b73bae0fd5712edd26eea4d02b4407b884a2a89bc77cb941e6daaaa00d37a9c73cc352bb0b2eb3
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 584 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6c8067.msi msiexec.exe File opened for modification C:\Windows\Installer\6c8067.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI81AF.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 2000 msiexec.exe 2000 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid Process Token: SeShutdownPrivilege 388 msiexec.exe Token: SeIncreaseQuotaPrivilege 388 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe Token: SeSecurityPrivilege 2000 msiexec.exe Token: SeCreateTokenPrivilege 388 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 388 msiexec.exe Token: SeLockMemoryPrivilege 388 msiexec.exe Token: SeIncreaseQuotaPrivilege 388 msiexec.exe Token: SeMachineAccountPrivilege 388 msiexec.exe Token: SeTcbPrivilege 388 msiexec.exe Token: SeSecurityPrivilege 388 msiexec.exe Token: SeTakeOwnershipPrivilege 388 msiexec.exe Token: SeLoadDriverPrivilege 388 msiexec.exe Token: SeSystemProfilePrivilege 388 msiexec.exe Token: SeSystemtimePrivilege 388 msiexec.exe Token: SeProfSingleProcessPrivilege 388 msiexec.exe Token: SeIncBasePriorityPrivilege 388 msiexec.exe Token: SeCreatePagefilePrivilege 388 msiexec.exe Token: SeCreatePermanentPrivilege 388 msiexec.exe Token: SeBackupPrivilege 388 msiexec.exe Token: SeRestorePrivilege 388 msiexec.exe Token: SeShutdownPrivilege 388 msiexec.exe Token: SeDebugPrivilege 388 msiexec.exe Token: SeAuditPrivilege 388 msiexec.exe Token: SeSystemEnvironmentPrivilege 388 msiexec.exe Token: SeChangeNotifyPrivilege 388 msiexec.exe Token: SeRemoteShutdownPrivilege 388 msiexec.exe Token: SeUndockPrivilege 388 msiexec.exe Token: SeSyncAgentPrivilege 388 msiexec.exe Token: SeEnableDelegationPrivilege 388 msiexec.exe Token: SeManageVolumePrivilege 388 msiexec.exe Token: SeImpersonatePrivilege 388 msiexec.exe Token: SeCreateGlobalPrivilege 388 msiexec.exe Token: SeBackupPrivilege 1712 vssvc.exe Token: SeRestorePrivilege 1712 vssvc.exe Token: SeAuditPrivilege 1712 vssvc.exe Token: SeBackupPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeRestorePrivilege 864 DrvInst.exe Token: SeLoadDriverPrivilege 864 DrvInst.exe Token: SeLoadDriverPrivilege 864 DrvInst.exe Token: SeLoadDriverPrivilege 864 DrvInst.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 388 msiexec.exe 388 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2000 wrote to memory of 584 2000 msiexec.exe 32 PID 2000 wrote to memory of 584 2000 msiexec.exe 32 PID 2000 wrote to memory of 584 2000 msiexec.exe 32 PID 2000 wrote to memory of 584 2000 msiexec.exe 32 PID 2000 wrote to memory of 584 2000 msiexec.exe 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Magniber11.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:388
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding BAC754DEADA34E59F1718E74BB74B7492⤵
- Loads dropped DLL
PID:584
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004E0" "00000000000002C0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD56e2b8071887c4662bb95923b7c14acf7
SHA13e186c237a37987037b96bd32761b58c56238c7d
SHA2562f6e10671dd552e2adfad918f363c76a08de7baa6df381af7c441d4ec10f4ffb
SHA5120c2e90416abd56296430b8b631bd2c2608e122203cec44158353897c56922fff82c4574377ef5ece8b9b2609fe2d7b5355acd2e6f74df159d61eaea5882fbf4d
-
Filesize
99KB
MD56e2b8071887c4662bb95923b7c14acf7
SHA13e186c237a37987037b96bd32761b58c56238c7d
SHA2562f6e10671dd552e2adfad918f363c76a08de7baa6df381af7c441d4ec10f4ffb
SHA5120c2e90416abd56296430b8b631bd2c2608e122203cec44158353897c56922fff82c4574377ef5ece8b9b2609fe2d7b5355acd2e6f74df159d61eaea5882fbf4d