Overview

overview

7

Static

static

3

driver-mag...-0.exe

windows7-x64

7

driver-mag...-0.exe

windows10-2004-x64

7

Resubmissions

12-02-2024 20:06

240212-yvjapabd8w 7

Analysis

  • max time kernel
    38s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-02-2024 20:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    driver-magician-6-0.exe

  • Size

    5.9MB

  • MD5

    17fc5c203f4e8b3e3b7a463fd939f57a

  • SHA1

    12ec48b63e89cb78fb47571e9c27b0a4e562bc82

  • SHA256

    b5b23f72ca2b97b42bc66040ffcfcddb8e5cf0e164464a5631ef2dd8f017985b

  • SHA512

    3ebfd9444dac6becfafcdf060bf543e2ab6765c2f9e6b78b7877fc21afea3e2e8ca6f21045baaa8f66ae0571ab688b4efcb177fb0dbc6c5839ceb4c9452a3de3

  • SSDEEP

    98304:FkLyusBFthivcrmEtw2r9mfuNy/wSuoAcu3lumwIICdSvOFg4XYq:GyusBnUvcyEO2hmf2K/AGmwIIESvOFgm

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\driver-magician-6-0.exe
    "C:\Users\Admin\AppData\Local\Temp\driver-magician-6-0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\is-KDV7N.tmp\driver-magician-6-0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KDV7N.tmp\driver-magician-6-0.tmp" /SL5="$40150,5248154,781312,C:\Users\Admin\AppData\Local\Temp\driver-magician-6-0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Comdlg32.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1608
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Msinet.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:560
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Mscomctl.ocx"
        3⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:1992
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\XCEEDZIP.DLL"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2896
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\XceedCry.dll"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1740
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\Codejock.Controls.v15.0.1.ocx"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:1956
      • C:\Program Files (x86)\Driver Magician\Driver Magician.exe
        "C:\Program Files (x86)\Driver Magician\Driver Magician.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Driver Magician\Driver Magician.exe
    Filesize

    448KB

    MD5

    89ac36ebd6b726bb9698ccc3202aba52

    SHA1

    2f7bab61ababbd7b497a61d26b55a7b5a214dd57

    SHA256

    52600238201d3186934d4d0a054bf91fe11da85364d77969ea0f06236f1dd57e

    SHA512

    5c8d0d014c041149d963395773e6ad5e6b5fd4477e4f4e8c2e1ca7386b930e094dd652a2eabc0f9a5e54c50cd846b7daceddbbe59ab57d00a5ad666035fdd8b4

    Download Submit
  • C:\Program Files (x86)\Driver Magician\Language\Spanish.ini
    Filesize

    17KB

    MD5

    00912856c5d29b59ffb6c01d00a4b3c5

    SHA1

    ad8b10b1538112ffb0c628b3b4637ccaa3d9939a

    SHA256

    a40f5b66a10ead481d95441505af8b62fe525cf31a1504abeb39cfbd7ea689e1

    SHA512

    0634609451525843c9587ae940d6df17f755a759e770886315384616451c858002b2c6acad890e005aed413a72f3b9e64dd1177f46f791d76f69ad4adb887178

    Download Submit
  • C:\Windows\SysWOW64\Codejock.Controls.v15.0.1.ocx
    Filesize

    1.8MB

    MD5

    6a021b290d913525f2f7225462172690

    SHA1

    501aeabe86439825fb99e9560bc2d00ac7442dcf

    SHA256

    7dd57f8763664a593c8bf2a0a86d9d70e8efe427e1474223642b5d541b51642e

    SHA512

    260d4f63b7a1a45aa49868ce12b2bd8464dc285e99413eafe559cd51995b421c5af22399b7a1987e172bcbc9f32d29fa3e3df3843bc587f8f2a3b1e5809c7a98

    Download Submit
  • C:\Windows\SysWOW64\Comdlg32.ocx
    Filesize

    149KB

    MD5

    ab412429f1e5fb9708a8cdea07479099

    SHA1

    eb49323be4384a0e7e36053f186b305636e82887

    SHA256

    e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240

    SHA512

    f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

    Download Submit
  • C:\Windows\SysWOW64\Msinet.ocx
    Filesize

    129KB

    MD5

    90a39346e9b67f132ef133725c487ff6

    SHA1

    9cd22933f628465c863bed7895d99395acaa5d2a

    SHA256

    e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2

    SHA512

    0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf

    Download Submit
  • C:\Windows\SysWOW64\XCEEDZIP.DLL
    Filesize

    445KB

    MD5

    044beba65ba31e1ca1ffc8cbbef78f3e

    SHA1

    55731a6c5043ad4e43735ee8434767953e562f71

    SHA256

    ccfd6be91993d92e95ed4552b9a0d62660eb675248175621286cf4133d5140f2

    SHA512

    802f7aef54e7965b83a12baf343bc8a4a84021aab918bb3bfa02d1f7447da7360e52313036559203620affdb30bc2f05582d04eabf796777aff1100f8d5f427c

    Download Submit
  • C:\Windows\SysWOW64\XceedCry.dll
    Filesize

    513KB

    MD5

    47086109df33378a73e15e25ee6a2d20

    SHA1

    731bcf4fcd068444289acb8ddcbb714bc2dbe606

    SHA256

    879bfa7d940e97363410ff148b40386cf961abe612d3ac197019f4d53513f243

    SHA512

    8ccb39dcca7de589a61f27fcb8727115919f75882b1e43ac3be5f7d9b0eb5ea211eeb74dd27bf91ac31a3a2c46599ca9bc9f5e515c0b7065674ed61b42dfd35d

    Download Submit
  • \Program Files (x86)\Driver Magician\Driver Magician.exe
    Filesize

    1.7MB

    MD5

    d01facc1ded1238c84dd4caaa377367c

    SHA1

    3c2b2001722c35bec4d8fdbb470ec6492bdba90a

    SHA256

    d4bfebc784e6519e1a05b4b36f90c2cf0f0ff7963206ef29a48baea4579878d1

    SHA512

    e7515603a584b5a4f6543de6173f34639c0e01c3486e1288af54cc83dfea0e2065801d07350d508a45578c703c9940436ee5b59977ead7782e029d5a8d807359

    Download Submit
  • \Program Files (x86)\Driver Magician\unins000.exe
    Filesize

    2.8MB

    MD5

    0bfe8125ff9363724a9389bea5fdb97a

    SHA1

    74f6666445b0057058ce258a9db63219013e8f05

    SHA256

    6e74281021e5b08e24ee766ae27fc29744688ec3ff0abba9c015d99f1e4fedfd

    SHA512

    544959cdaaac4a94fc85e75a548081c11208bcb88d94b1520e2f02033132e8456d740021dece6f84b0f02384b6b77001fb9f8d23749a3b02398acb021e1076a2

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-KDV7N.tmp\driver-magician-6-0.tmp
    Filesize

    3.0MB

    MD5

    0e02525d17fac66dbcc6a0015193cddc

    SHA1

    ef45af9e44ebd24f045a6c0dfcab237d597e8b98

    SHA256

    7807003ff76c839400f8c386d1f9b00b236534a5cb376a4cdf0b0316e3ef5e20

    SHA512

    988236d11b3685ae36f2f68d47df25c8d8aa1f02fd15042a0832b03741e8a9564062b77d7ab46441d3ac856791fc038457f504b2c2134a9e263e220ed50db1b0

    Download Submit
  • memory/2096-10-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

    Download
  • memory/2096-1-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

    Download
  • memory/2096-125-0x0000000000400000-0x00000000004CC000-memory.dmp
    Filesize

    816KB

    Download
  • memory/2880-8-0x00000000003C0000-0x00000000003C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2880-111-0x0000000000400000-0x0000000000708000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2880-11-0x0000000000400000-0x0000000000708000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/2880-124-0x0000000000400000-0x0000000000708000-memory.dmp
    Filesize

    3.0MB

    Download