Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2024, 19:43

General

  • Target

    2024-02-11_255ce9e97b243434ae2f24096609f64f_magniber.exe

  • Size

    3.6MB

  • MD5

    255ce9e97b243434ae2f24096609f64f

  • SHA1

    7d09b86df4ded4645dd15efcb7d438bf06dc8d7c

  • SHA256

    75def47f7ec0a5962c37f81ad7ae30addc8d3dc1c50e39bd8e162be72fbe5888

  • SHA512

    366948c122ebc03ad6c4f1b9f1fddbcb96701b5dde11172e64007b558d8c062febfacdcba12a7fd8760f988d2a5a2567255aa25fb360eba69b47e91a25b4b6af

  • SSDEEP

    98304:q1JFkPMqxEq29HsT0trPMLKRNxYkUsGvT:q1CxE5MT0trELKmhv

Score
8/10

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-11_255ce9e97b243434ae2f24096609f64f_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-11_255ce9e97b243434ae2f24096609f64f_magniber.exe"
    1⤵
    • Checks processor information in registry
    PID:3080
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\SpreadsheetTools\64\LockXLSRuntime64.dll

    Filesize

    2.4MB

    MD5

    c34a83705bc5f0f7c1f0529241952795

    SHA1

    fb9054d4cbaf5ea634e7a312438d8ea3a8c20ef1

    SHA256

    a08cd5073378c16d4ba2c1c70fe84b698b8c681fab20f5e2f582f8d22f510d78

    SHA512

    ba366ae41223be397a63beb8945d50c439167e765385c878645e648b47362af08479938b8077fefccb10820cbbbb643519e487c515a086aba25c63b122974057

  • C:\Users\Admin\AppData\Local\SpreadsheetTools\64\LockXLSRuntime64.dll

    Filesize

    384KB

    MD5

    761a4d6332be96ae52fb4cdac861ca14

    SHA1

    d6ad2c0d00800d1254ef49b028782da43f03cc82

    SHA256

    1faa947b39bea8a3239f7ca50bb1463522b8049a440707a19eaf9ee682d2ba69

    SHA512

    85ca0fff72283a24db752484adc575ddea94f424f8e231bc8e22e087d1acd174fd8fd9353a0f986f2a8bf6dc4c7868fd011fc811ad7ee9f973736e0d539ffcfb

  • C:\Users\Admin\AppData\Local\SpreadsheetTools\empty.xls

    Filesize

    22KB

    MD5

    29c44d16abfff0d8ccbd43a80871a904

    SHA1

    5f6417443a42856fd13d90e56153a8b5d272dffd

    SHA256

    63c99e16ff5432d4432fd01de90d549f1c898049d63422450cb93ab8e29fdb2d

    SHA512

    ed62a24fb42abb49a8c23aab6c4e140b4b98a25227c100f9c8081f325ba3a41d6b49a5628a704db7f1207bc0c3bb852ea02d88f4a868e7ec1f2ddf599d0839e7

  • C:\Users\Admin\AppData\Local\SpreadsheetTools\lxLdr.xlam

    Filesize

    26KB

    MD5

    68ae3f8f60641e3b6e40c907e9f01daa

    SHA1

    204d0f28e2970af8a6727198b88edbfdd19d5c51

    SHA256

    759024e88c6e0063004bb09392922af4010aec87dc7c8377451c87ab13a68bf0

    SHA512

    443d53552354407df61d688223381bfc31f61c6b2bf9618f38e18f74490e8f98ad0dbb3128990c58b4f3094790908b84eb63e62070c337385c20c8a8699bcbcf

  • memory/4492-9-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-8-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-11-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-12-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-14-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-13-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-16-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-17-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-15-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-10-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-18-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-19-0x00007FFB87030000-0x00007FFB87040000-memory.dmp

    Filesize

    64KB

  • memory/4492-20-0x00007FFB87030000-0x00007FFB87040000-memory.dmp

    Filesize

    64KB

  • memory/4492-34-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-39-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-41-0x00007FFBA21A0000-0x00007FFBA2418000-memory.dmp

    Filesize

    2.5MB

  • memory/4492-42-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-43-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-44-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-45-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-46-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-53-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-57-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-59-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-61-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-62-0x0000020A9C020000-0x0000020A9C220000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-65-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-68-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-70-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-71-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-72-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-78-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-75-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-81-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-82-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-83-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-84-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-85-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-86-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-93-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-94-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-95-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-96-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-99-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-103-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-104-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-105-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-107-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-108-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-109-0x0000020A9C020000-0x0000020A9C220000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-110-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-111-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-112-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-113-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-114-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-115-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-116-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-117-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-118-0x0000020A962D0000-0x0000020A972A0000-memory.dmp

    Filesize

    15.8MB

  • memory/4492-119-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-120-0x0000020A93B50000-0x0000020A94350000-memory.dmp

    Filesize

    8.0MB

  • memory/4492-129-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-130-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-131-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-132-0x00007FFBC9340000-0x00007FFBC946A000-memory.dmp

    Filesize

    1.2MB

  • memory/4492-133-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-134-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-135-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-136-0x00007FFB89830000-0x00007FFB89840000-memory.dmp

    Filesize

    64KB

  • memory/4492-137-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-138-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4492-139-0x00007FFBC97B0000-0x00007FFBC99A5000-memory.dmp

    Filesize

    2.0MB