Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe
-
Size
6.1MB
-
MD5
78acb3b7c9354ccf719d0ae713ef08e3
-
SHA1
c2b24919fe151b9e2f717e6767493874305d3853
-
SHA256
63e7829ba5553ee0d861e20051408bd541b0de18ab5c69f00def35f7e56049b7
-
SHA512
79bcb0bc79473fc659f46fa0d199d9eed5ed574186785c7e82906e367e43e3ac820ad73b9d07d111546c4551e1ea1be3e36bac1a8da7637bdc2fe8e01785fac5
-
SSDEEP
98304:B8GujOgW+vPhqeVHSzRmz1bOL+PnXcwdauoUnIlwsxs4D4eFLOAkGkzdnEVomFHo:B8GchvPbPnswXolw4seFLOyomFHKnP
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe -
Modifies registry class 15 IoCs
Processes:
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\NoWorkingDirectory 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\command 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\InProcServer32\ThreadingModel = "Apartment" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\ = "@shell32.dll,-8506" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\Extended 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\command\ = "cmd.exe /s /k pushd \"%V\"" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\InProcServer32\ = "%SystemRoot%\\SysWow64\\windows.storage.dll" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\ShellFolder 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\ShellFolder\FolderValueFlags = "1572864" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E} 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\ = "Desktop" 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\InProcServer32 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C16DC5F0-5740-27A5-80ED-A636862B477E}\shell\cmd\NeverDefault 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exedescription pid process Token: 33 4556 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe Token: SeIncBasePriorityPrivilege 4556 2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_78acb3b7c9354ccf719d0ae713ef08e3_mafia_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4556