Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    03/08/2023, 17:22

General

  • Target

    51f4db24f76b9438198cbbd6de8268c7_magniber_JC.exe

  • Size

    580KB

  • MD5

    51f4db24f76b9438198cbbd6de8268c7

  • SHA1

    d2ed64ca270241ea98cd1906c346deed864b005d

  • SHA256

    2d9be833372f380e739a3277dabca4dc0b2166cbacb445e70bd06e8444d502a6

  • SHA512

    cb427b0c86b3a4f9330ad11c4c7a53e062ff60acb0bd989d4b8f5824f843471ffbd9329a03ec09a3f9dd156164dfe5dceb745a08411997606b289ac8ccb105c3

  • SSDEEP

    12288:J7vnO4/YjM+yGbIMkVkWTjvoQDbKtIvK5:pP/IylkWPoObKtIy5

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51f4db24f76b9438198cbbd6de8268c7_magniber_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\51f4db24f76b9438198cbbd6de8268c7_magniber_JC.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\dfs871A.tmp

    Filesize

    282KB

    MD5

    ec289a0acf4bcfd8ee9cba8b18d7ce0e

    SHA1

    e312ec699681ca9b879bf381a81c6e96057235b3

    SHA256

    9dfb9baa312020daf0906d24e491b76061cc9971a8abb9e82625a4773af6ac21

    SHA512

    934f8a2850a28d763ae5289d23029cc83983415a09c4408b5ccbc6ee66d2b01b0029ca0f5fed1183c22e19ca34f3601f627c1c251bf140368124f1b2c3f565d0

  • \Users\Admin\AppData\Local\Temp\dfs871A.tmp

    Filesize

    282KB

    MD5

    ec289a0acf4bcfd8ee9cba8b18d7ce0e

    SHA1

    e312ec699681ca9b879bf381a81c6e96057235b3

    SHA256

    9dfb9baa312020daf0906d24e491b76061cc9971a8abb9e82625a4773af6ac21

    SHA512

    934f8a2850a28d763ae5289d23029cc83983415a09c4408b5ccbc6ee66d2b01b0029ca0f5fed1183c22e19ca34f3601f627c1c251bf140368124f1b2c3f565d0

  • memory/2192-62-0x0000000000220000-0x000000000022C000-memory.dmp

    Filesize

    48KB

  • memory/2192-59-0x0000000000390000-0x00000000003DE000-memory.dmp

    Filesize

    312KB

  • memory/2192-60-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2192-61-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/2192-54-0x00000000012E0000-0x000000000138D000-memory.dmp

    Filesize

    692KB

  • memory/2192-63-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/2192-64-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/2192-65-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/2192-68-0x0000000009F10000-0x000000000A6B6000-memory.dmp

    Filesize

    7.6MB

  • memory/2192-76-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/2192-77-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/2192-78-0x00000000012E0000-0x000000000138D000-memory.dmp

    Filesize

    692KB