Analysis
-
max time kernel
37s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/04/2024, 16:04
General
-
Target
2024-04-05_f1e3325bece9c6cb68ef684d4061e6ea_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
f1e3325bece9c6cb68ef684d4061e6ea
-
SHA1
ac5a013e0afa6cb0e049eee8a4c5830088218822
-
SHA256
143cc091b13e22737efb089dc1e9c6101d0aaa4dfd2617d01d37389f42d7ac81
-
SHA512
15e1404adf31f39ee923c4c4869ff9e91ef7fc5ffa6253d1170cdb6e60a7c5309881f0144f83803a2e4980d3c9680dace12831fc7d04172cbbb958cc82ee7b78
-
SSDEEP
196608:cP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018d:cPboGX8a/jWWu3cI2D/cWcls1
Malware Config
Signatures
-
Executes dropped EXE 17 IoCs
-
Drops file in System32 directory 19 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-05_f1e3325bece9c6cb68ef684d4061e6ea_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-05_f1e3325bece9c6cb68ef684d4061e6ea_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5abc0c378fef6cbf1a66ce773569d0fa8
SHA1ebe2307f3df64bf39a22ddc533f23a815a0173fc
SHA256677722f45186c0344d76fb2af16e27be485d41f96f2b993c4708ee0eadd01539
SHA5128d1def1f50b839b4d7032152c6278eefbd169356536da037cc2630679d03b8c469c9cc293aebba50f72fe4a998e057a5b8c7d2dbc61d5e10a04fd5f4bb4d613b
-
Filesize
781KB
MD531f6f0769e756259c33eec775fbd2204
SHA10fc6c7dbf242a325289012a6e82ce19835e924d8
SHA256eaa4788539dcf26876a90a420915ed1baa7491b89114ef63a315bbbb3c02dd99
SHA5124e048f870cad711f1574e6b0928a1c4f44bb61b05bcd0ed9b06e6554f626cded45c76c431fe3a11567ebf5763ccc5d65649ad2d9bd8f17276f4b078e571b26e9
-
Filesize
805KB
MD57eebbf528b1154082d7335177e10f847
SHA1ece3fcccf239886925d86b5bd3cacce64ebc0612
SHA256d1615d257293956bbb619c7bf3a8de8db6817f664ac2f91346877838b3eb2c6a
SHA5128c879977ea35f020f5995068c4997d8ad976d6d0d73694011974721deb8f138c70f994cce4faeddc808f29797063c7a97648ec24002b50e5881dda20fce93e11
-
Filesize
2.1MB
MD57039294ee599dba5540b1ff525e5963b
SHA1557bcb2bb2bd444c1804ca7553a9341b49cca481
SHA2565fb63dd609c0577324982bbd2feb3e3b4994105daafbf4c083e9ac3114f5dfa6
SHA512dc100edf1c45879959755d6213da900569de26cfd292b8e9dc4588cff54e86c6d7cb174b5e857765d3981957c30f0443bd4c7b0d30d11fb8e1f5f259c02b43c0
-
Filesize
588KB
MD5b615835291c7ef305612ad152abf8b0b
SHA1f6c6b61e415be22233f747e091fdbd5bb2aa9bef
SHA256e104656ea61bf7c51c24d91c18a540805a47530b4a527466d67e6b93bc12ce7d
SHA51277a9fcbb9bc0a9cd45b977b72f833c02d1211d300cf6a42ba28781c2635bebc6bd0c7a1df0d3293ddde1c06d035863c8ba503add0470a3e49ec1cf773a7fdae4
-
Filesize
1.6MB
MD53db90f0ba74da170ef5353213b9b24a4
SHA18d60db9653924a7f859eadb402f383eaae0665e1
SHA256a51ae7421b0728a2b207c00998d8ff7bea807e9dc698470ad08f805295d0e3df
SHA512782be16dd437959681648a961c21147e85379a1353bfc311c05c03dd322513efa3f17643d5f8cb8b6877928449cfd0ad3eee826247c8505d9b4fce918ab0240e
-
Filesize
659KB
MD5c0364bec7e3bb1adba41353e2e990f9b
SHA10f1ff486765caf55e8886e3cdcf9995181a087b8
SHA2566da8bf319e5263dffda9600aa273de882eeae46c16f7bc363bc95070ed3b0cb3
SHA512b742d2ec090d77401c5ecf3ce2bb80cdd085076419b6c7b2f64ce31a2bfd82a479b81e8109990f7b7da51a4031a51ebfd0dfb1c1d1f2aa6122c903466ddb8c92
-
Filesize
1.2MB
MD57e4081461b9b9664f9d6951c4d6a3bf1
SHA129769936de2ca15d789d15f7634a4c0350aca0b6
SHA256caafef83dc18fc53f28428607b703e64d1f728a8204631378dce0c975acfc451
SHA5128763080b2afea371a7dfaf7d0b4d8f02692e3d440c62e94bdb8da47aea309a81dd92d2f160a965c5c52fedf5b9b9d2d41cdf8fa50b83070a303029e26d7c70dd
-
Filesize
578KB
MD5431b7ae42ccd42829470bfbf12c8d5ae
SHA19c0df8f18f0b0875baea0421cfaa680d52e04910
SHA256701c56ce2b8ed3da29cd22f7189d09ba91cc64d7eea98421398d91a84a9fb454
SHA5128c62b05f23a8da26a08c2610f19eca73da2bd11968647ca15f064533a9fde70016233b3b0f6b2e9f2e9501221bf6160f4a3b72e6faff5ef39570bf1067b6440f
-
Filesize
940KB
MD5afbb0c5121673d43c13d30fb6feda058
SHA1bd5c4c97c6d347dfeb12056a733c987b1ff615b4
SHA2565a1cf5c51f0ecc68ddf756cae45b630f8970ddf03586cb38dae229e8002827c0
SHA5126c1869836bee23a1d10890f9fc1bc525507344f16af4b7d75a0af6cfd921d8b995747ae2464f1bda71cfa3bceb1a72f65c1a2e4b39a99b721e535d01095af2a3
-
Filesize
671KB
MD53bcce9ad9b94c5def9aa238f0009fd17
SHA15c70a098eb651f79268065e226487ba0ff97ebd3
SHA256d12fe85c2f0ea0c290081809cd5f1982b7c1ccadc9e520dcc474184e1031ad6f
SHA512f558447cbdd562439f63bdd47558b411869e032d4d572a48238b077af758cfd023896cf51d9bb82e5b868ab9707e177fd457fda63884dbed7c50acb99f74fc7b
-
Filesize
1.8MB
MD548d207a500fddc94f17866d1fc0be4b1
SHA1d673c250499de6fd4bdd4c6cb3c8c90934ef691f
SHA2569a9fb998f28b9993da41005587a84f8f3e1db68e292489ce7574258c416068b9
SHA512b12a31686b6fd4c83fbaef9e31f24621353a9c32773d7be3c781c65a10e87c1f2bc4573d70ec918e6d38bc081088168ceac748558b39ad12bd88f9c8c7943283
-
Filesize
1.4MB
MD5c96b169ce2d8d189c76e4e14f49c31cf
SHA149bfa4d5b355599fe8201f70a455c993d0bb6949
SHA256a927cd04a72b4434f29eab0b2e6df237c5c130baeade2d90babef61535a19a87
SHA512e11b5fdb034a88dac426ec1e22236e2365e2b870e2dcbfca87c6483f23cae75239e64d82b30814e937723c76ea018c40154e20d19fe938d3c2d1499f05ae7012
-
Filesize
885KB
MD5f7f6846cd23a8c2183b0eaada1f6ac5a
SHA127bb8815e61cb8d57588a50e7979f74596517b74
SHA256f0a8dc35cac30d3db9f908fe85ac0c173c3ba5169fdc4220c06b835895c9d8f3
SHA512883f4b5c9133c56a5f7e3779ad44b624652fbb1770457c83a521de41a58c556194777791c362d34f47f1ab7a96e0f873551a0b02bdbfac9317e3ff19ca9c8dd0
-
Filesize
661KB
MD52623922c76564dec05f7fdb8c9e059a4
SHA1af7da13f8d8e56721cfbbde9b7bbde42731811ea
SHA25617a0a093824e6fcb1a7b6a3a0863279f4e0b8e574549e991f9529a998a555cf5
SHA512599ea9b8edfedeab631216e9b3393a068aa501df419ac7a0b472ff7a5cf1cadc3d587ff494a3909f04f469ac5b417fe5dc8588a390be9c26292eaf912db07f85
-
Filesize
712KB
MD50d780e57303079dadc8f4fb28d102701
SHA125dddcf08fd0379c335dd153d1fc85e057917495
SHA25669dcd04198f1667f839ce7819236823f6e5edadbc61d4569b4e0f633580e99a2
SHA51200dfbead637c0be88db8f4be2ab0359b110d8c121f6c098465efa89e60b144aff8ab81d8ff7dda78227d8877a3124dd6f624cdf3ce0c4df6a0cfef48e4980b6d
-
Filesize
584KB
MD5ff4e6dbfab87e7eb4543010b66349702
SHA107b55d99df1cc2aa4114655f662ba8d5bbb1c896
SHA256c607339dfff2dc2fe8c9f743ec5d74975f45280b3af5ae283be0438ac951b828
SHA51271d957f6576d932eb3abd5708b22b790e406318447b3ae034bcd54b5faf96db749946fbad31eea42655892c499a633126f15b0e08147d1307bcb0b35206fed34
-
Filesize
27.0MB
-
Filesize
412KB
-
Filesize
27.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
676KB