Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 17:22 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe
-
Size
23.2MB
-
MD5
361ea8209630ea1fc1e212ce23ee9b27
-
SHA1
8e8272f9890226e0bd28dbfb6e28eb335dfd57aa
-
SHA256
0a11f0af4b75f972200c636beebf476aaeabed96f77e8bfce49c73ed86239e74
-
SHA512
14a96e52fa60ab33700f82a0c8a5979c25706391d982f4ac975be11921a2b9b00d47b80610078e976d21f3188accb6e6a613af480f856669cf71a238d8862b40
-
SSDEEP
196608:lBY376DEtUmaIsqY4tdqYrKcxos1+11dFY9IPqYZvUqYneXmzWLy3TXsUkKneBSq:HY376DCYie4kTxz7lydH0GB4I+v/Sa
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2088 regsvr32.exe 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Enumerates system info in registry 2 TTPs 30 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\ = "ANY-maze Bitmap recorder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AMBmpRecorder.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\FriendlyName = "ANY-maze Bitmap recorder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}\CLSID = "{5B8A312E-9BA8-4C95-9A73-766BE53CED7F}" regsvr32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe Token: SeIncBasePriorityPrivilege 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28 PID 2408 wrote to memory of 2088 2408 2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_361ea8209630ea1fc1e212ce23ee9b27_magniber_JC.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\AMBmpRecorder.ax"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5effc110606c472ae3bcd245ffc988749
SHA1519e6ec1908adf2dc02f6fcbfbd6f552de7b70e2
SHA256b6f60f30f91f425aec30d2b67ec958939857bdf170afc14ebb0efeaed06202d7
SHA5126df5d4d9927c279f1c15e03ff56e893108b29089e576ab2abceaf2400189136df6d2faac2e594307bb18c64400fd247007779bbc6d0e5c11f8d914e871133d56
-
Filesize
6KB
MD500724a42d9b9dd736bb3a63bc0b3dd22
SHA1b6e766cd72ab70bbed7a3dac0558883e9b5dab73
SHA25668ef128fd3e493cb3f2adf1fd6f67f65a5612332568db2f26ad6afeba00050b5
SHA512c0627783d45b8515bce068c1670a242ae9ac4a0153ede494dea9e13553c085b29545df72197f752e23ebdf89137e3145ed01d83678a0b31d746500f081e0de13
-
Filesize
1.4MB
MD5effc110606c472ae3bcd245ffc988749
SHA1519e6ec1908adf2dc02f6fcbfbd6f552de7b70e2
SHA256b6f60f30f91f425aec30d2b67ec958939857bdf170afc14ebb0efeaed06202d7
SHA5126df5d4d9927c279f1c15e03ff56e893108b29089e576ab2abceaf2400189136df6d2faac2e594307bb18c64400fd247007779bbc6d0e5c11f8d914e871133d56
-
Filesize
1.4MB
MD5effc110606c472ae3bcd245ffc988749
SHA1519e6ec1908adf2dc02f6fcbfbd6f552de7b70e2
SHA256b6f60f30f91f425aec30d2b67ec958939857bdf170afc14ebb0efeaed06202d7
SHA5126df5d4d9927c279f1c15e03ff56e893108b29089e576ab2abceaf2400189136df6d2faac2e594307bb18c64400fd247007779bbc6d0e5c11f8d914e871133d56