Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe
-
Size
3.8MB
-
MD5
a372cc3b40e5444cf30cf18086e26329
-
SHA1
5801b003420f6dcabf3e8ccbd91ae83736c9d9fe
-
SHA256
87e6e962aef061c937e312706887ee5fa798358f751603d36b1da203b179a300
-
SHA512
eabac344a1850a92a09a9a0538d01dace7a3f5c3672461dbec9bba6610920d01296607bd9cf58f244c7b337bf3145414c6dcd384ad46a52a371bc5f1fbf22b44
-
SSDEEP
98304:Kzh1pjZmErOuPSDuzO0E0nE/jUt3M7H7qdk:KzhnsEquP56knJ3wH7qdk
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A} 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\ = "OLXView" 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\InprocHandler32 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\InprocHandler32\ = "ole32.dll" 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\LocalServer32 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE" 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{887BF051-ACD5-3280-2F73-B27140EDA99A}\LocalServer32\LocalServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b004f00550054004c004f004f004b00460069006c00650073003e005500330069006f006b006a0040004a0069003f0035007600320062006600790076003d0046002c0000000000 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2000 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe Token: SeIncBasePriorityPrivilege 2000 2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_a372cc3b40e5444cf30cf18086e26329_magniber.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2000