Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 03:44
Static task
static1
Behavioral task
behavioral1
Sample
Magniber2.msi
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Magniber2.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Magniber2.msi
-
Size
10.6MB
-
MD5
cb152752867af105819552b9086a8c76
-
SHA1
f8cd1daef2428e9c01af3e1352e694c2f48d6cdf
-
SHA256
fd5979d5ad2b2d68d7e5508c2d4e0147241e379a9115c0771d8bb56e2692db8c
-
SHA512
9bcfa1f55d329149b1025dfd68ac3c5045a764427723d1b7b1e690bf973c99756865a0cfbf7dce17a83552562c3c193fb75bdda8b6f7550a6d24297cdf670f81
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 1704 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Windows directory 6 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6c6826.msi msiexec.exe File opened for modification C:\Windows\Installer\6c6826.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI68B3.tmp msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 1432 msiexec.exe 1432 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid Process Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1432 msiexec.exe Token: SeTakeOwnershipPrivilege 1432 msiexec.exe Token: SeSecurityPrivilege 1432 msiexec.exe Token: SeCreateTokenPrivilege 1960 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1960 msiexec.exe Token: SeLockMemoryPrivilege 1960 msiexec.exe Token: SeIncreaseQuotaPrivilege 1960 msiexec.exe Token: SeMachineAccountPrivilege 1960 msiexec.exe Token: SeTcbPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeLoadDriverPrivilege 1960 msiexec.exe Token: SeSystemProfilePrivilege 1960 msiexec.exe Token: SeSystemtimePrivilege 1960 msiexec.exe Token: SeProfSingleProcessPrivilege 1960 msiexec.exe Token: SeIncBasePriorityPrivilege 1960 msiexec.exe Token: SeCreatePagefilePrivilege 1960 msiexec.exe Token: SeCreatePermanentPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeShutdownPrivilege 1960 msiexec.exe Token: SeDebugPrivilege 1960 msiexec.exe Token: SeAuditPrivilege 1960 msiexec.exe Token: SeSystemEnvironmentPrivilege 1960 msiexec.exe Token: SeChangeNotifyPrivilege 1960 msiexec.exe Token: SeRemoteShutdownPrivilege 1960 msiexec.exe Token: SeUndockPrivilege 1960 msiexec.exe Token: SeSyncAgentPrivilege 1960 msiexec.exe Token: SeEnableDelegationPrivilege 1960 msiexec.exe Token: SeManageVolumePrivilege 1960 msiexec.exe Token: SeImpersonatePrivilege 1960 msiexec.exe Token: SeCreateGlobalPrivilege 1960 msiexec.exe Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe Token: SeBackupPrivilege 1432 msiexec.exe Token: SeRestorePrivilege 1432 msiexec.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1392 DrvInst.exe Token: SeLoadDriverPrivilege 1392 DrvInst.exe Token: SeLoadDriverPrivilege 1392 DrvInst.exe Token: SeLoadDriverPrivilege 1392 DrvInst.exe Token: SeRestorePrivilege 1432 msiexec.exe Token: SeTakeOwnershipPrivilege 1432 msiexec.exe Token: SeRestorePrivilege 1432 msiexec.exe Token: SeTakeOwnershipPrivilege 1432 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 1960 msiexec.exe 1960 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 1432 wrote to memory of 1704 1432 msiexec.exe 31 PID 1432 wrote to memory of 1704 1432 msiexec.exe 31 PID 1432 wrote to memory of 1704 1432 msiexec.exe 31 PID 1432 wrote to memory of 1704 1432 msiexec.exe 31 PID 1432 wrote to memory of 1704 1432 msiexec.exe 31
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Magniber2.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1960
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 03A54671D7748ED4865EC98652998C812⤵
- Loads dropped DLL
PID:1704
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000494" "0000000000000060"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD55020274a62dd8711387e218ccb4d864e
SHA1a2da2d2a55924e13e46fb3efb42c0b735ec67a27
SHA25610e398018b3973dee2a3ecfefc4e9f2c57c2a6932bbea90e3dc9808ed772d2f7
SHA512775fdc377b949c5e5b3dd667c875878a2affbb2f5d9846afb9d8b511783af7dbaf8f9e7dc7778922bc3133ba5bab2bb3b329c35609803252f9686d7a46a18898
-
Filesize
107KB
MD55020274a62dd8711387e218ccb4d864e
SHA1a2da2d2a55924e13e46fb3efb42c0b735ec67a27
SHA25610e398018b3973dee2a3ecfefc4e9f2c57c2a6932bbea90e3dc9808ed772d2f7
SHA512775fdc377b949c5e5b3dd667c875878a2affbb2f5d9846afb9d8b511783af7dbaf8f9e7dc7778922bc3133ba5bab2bb3b329c35609803252f9686d7a46a18898