2a1f3b8aee92acf6c5771d98acdc4b9dc967dd4e7cc7cb2914e96356417596be

Analysis

max time kernel
145s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03/08/2023, 16:01 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
Size

1.2MB
MD5

4ac9c9a821fc1752efeb9a2041745459
SHA1

15a037da5fe9da595648472726625187ef8a4ee0
SHA256

2a1f3b8aee92acf6c5771d98acdc4b9dc967dd4e7cc7cb2914e96356417596be
SHA512

d0e45afeab323bad078c5d2c8194a2f12a4fff119b80817e3286851275aa9b70f4a1edd1b195f9561ca21a86ef10aafb80ef21a8bfcdf3df19a195fa96f1a5fc
SSDEEP

24576:nDHsykr7MhoKW/kGjjG7btB6lGogmMap/eL:nD9cDN/kqjG7paI

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2340	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
2340	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
2340	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
2340	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
2340	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28
PID 2896 wrote to memory of 2340	2896	4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

DNS

stan.mxp2069.com

4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe

Remote address:

8.8.8.8:53

Request

stan.mxp2069.com

IN A

Response

No results found

8.8.8.8:53

stan.mxp2069.com

dns

4ac9c9a821fc1752efeb9a2041745459_magniber_JC.exe

62 B
135 B
1
1

DNS Request

stan.mxp2069.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-56-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-58-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-60-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-62-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-64-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2340-68-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-74-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2340-76-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download