Analysis
-
max time kernel
26s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 11:38
Errors
General
-
Target
2024-04-22_50ee55fc28e486eb976689c4c14472b4_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
50ee55fc28e486eb976689c4c14472b4
-
SHA1
f8693361decbf337cf9b162277d071ca2a654b82
-
SHA256
81ef05dde420e96b8e8a36f34fbce389a7a4610bd485c14b364c37d3b77bb2cb
-
SHA512
c6f52a4872f37cc3f7208b10b9107af06d4b11f08c23f7ad3e35c701a6170d10a195324e564157caa6c58450b5a0ab8f6278605edf7967cc0fbd5a5276aad20c
-
SSDEEP
196608:hP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018oZ:hPboGX8a/jWWu3cI2D/cWcls1B
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 47 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_50ee55fc28e486eb976689c4c14472b4_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_50ee55fc28e486eb976689c4c14472b4_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51310c5b27289a06903fb28a32796c98f
SHA143ad1eda211e9cf927636f02d407bd580512df4e
SHA2566131b745b560c5ab3a669af4d80f26ac46f9334d1c12bed4f25be560c33502de
SHA512bf29862cebc6c0e94bd49b1720291163af539d8c08532967a6ddf4664a606aafb93aec9ee4eae7506759c9b84f186361f65c194a4f28d4d327805b5aabc7f199
-
Filesize
1.7MB
MD525810ad1aaab1218e924d9744132c806
SHA1f9f7076506185c44631f9075e97e2e441b772821
SHA256873cb03b69f58979a5031fd38e3b88ce4f74f5c6098d621f6e83d323c3c2e01a
SHA51273ff5be19c5887dacd2fe3687f3b871fd46844ac13182ced0d1504246b8f6821ae5851cbf192a00932be3936d8da539026be88fa992ee9b79b0fd235e532de7f
-
Filesize
1.7MB
MD5bb3f97420c5345e3e03f6cd05c896d2b
SHA14614dd24fee915afd2521cc5bf9143306736bc4a
SHA2560f89978807aad6c73ddc6def888517c8c617cbd6cbf5960e27dbb9f2b45afc81
SHA512ea533e9c8d1838b15586e699219bc5b788f9cf67c8d5fd3c1cd011e5d5343b9db57b64d6cc34d3ba542aaf63448ad91e75420fc0dec7a09be17cff930338265f
-
Filesize
2.2MB
MD5cd7ec55e22947ea79fa3ffd1f0f94ffb
SHA180aedcf775db26160881a7ee011298dd0fc40599
SHA2561fc6b1fc9c2bffee704957ded634a5b590d291d97c10937da7dfc4d2f0077bbc
SHA51223c098ee6560724980d290dd02f52fdbdfb3640f2390102f4d9339faa1cc8ad0c6b95b71ae93a4284cd4eb217b81a25a83b2df4b3df8a1268e47701c0cd53886
-
Filesize
1.5MB
MD5ffd024abf289037e5471cde4e9b97a61
SHA10dace52edb5fd256c2bfea9f8eeb0914ad029119
SHA256f61b3c18b6272607847bdfb2ae704f29a1f1d356c6f5c764e017bb4c4f9003c3
SHA51200cb5f8d8fd444485b5e608311e55f205c9c4ff5c4b47774fb0815d9fbefced7a0ccd1865c82c353e6c8359b8679ce0de99b17c0978dbbcc52be98b373e4b0de
-
Filesize
1.7MB
MD5de040c4a0efc84615f92692516503227
SHA1f8a720bb1284fed485b124c97f712940eefd38f2
SHA256f7599360ef34c52e2cf1e3e0afc7029943f101bd78c5b7b770271ec979e93cd5
SHA5121d0a85b1332a5b5834befc7bb981aba1857045ebe9298a379ded3a091030315a37b8e76eba2df67582df6ec26848f6fe808015208c857730c7c98a38bf57bf57
-
Filesize
1.5MB
MD5575c022e2694dcbe41d9320dd64f7140
SHA18100e871b97fa23fefebf94689466ecab09d525f
SHA256161b59f8b094718d485fe5a74a7e91a49c472f8023b1cd20416cde06da23291e
SHA5121b3dfc9950f39c979d3c997dd58dfc6b26931570c2c13b8dc38539ac0e1fd5e4c43baae1e4cbb2533c3345aaa7acbad9f14955fbc38413cd0f16438ff213441d
-
Filesize
1.2MB
MD529ef0096832bc8fea7f47e5ab053e467
SHA1d8eab7953fff820f413cf8a11bf0f30e7b48c556
SHA256eba3864b5c8040e4766717a1fa799446970a13b318e6b5e60a0fab4fdfadca5f
SHA51219dd6bd3c236da3aa2663bd7e6294dfa977c11052f058019d8def6621a8d4844c116e3771c9caa153457bb1cec53673c9d66d71f5c9392b88107e77f78022a6a
-
Filesize
1.5MB
MD529f75b1e882ddcd788f3241620e53388
SHA189fd5e0665dc4a14f0c3c37a802a10e6cd5475ed
SHA25649d5e5ce6035c262896841b9c752b39bc04e2e98509e6f9df832c8e472c2261d
SHA512532b8908252da9ec45d0feb30cc43d16f776d1a6185f3504538047103fd2be3537bf1b7589efb0819473159ac46cfd0e545c572ad82990ebddb6b1166702985f
-
Filesize
1.8MB
MD5b761f9494479417e61a1fea66b7ffa07
SHA19df82659ed33f8df4a82c6c035b629d01430dfa4
SHA25677d6b0d0c6626c32bbc37cd3ceea2c83aa449d541861efa8d9aa450b104bd1ce
SHA5125bdfd4dabf3dbb7338aa897fd645f28be1b8ee3b7f60a01cdc4de51ed86b1fbdec5a589993dbf8cd7b91ce5c9285cb5ede201fe9e83fbc21fe6ea9459803d9f7
-
Filesize
1.6MB
MD58a6dba8b9a378b92f4d2767f29917da9
SHA1b8f356f8daffbfbcc3cc84679beac196b221c23f
SHA256bfda233ba5e274a678b0ae180574e827211a7541ba1075da76d2d5e08c40bcd8
SHA512d61ac7c53228bc20e704410098e9c2a679e47ab5874ce28f2ba7643d6a1f05a0b1d58bfaaed01673214630f6aa5b8302bc86405d640344be768fdc139efd21c3
-
Filesize
1.4MB
MD57aceb25abe619f8a43777817149ca161
SHA14944222542142e0ac8e655eb4c781cb6e8c7c132
SHA25610aab336bcf78308ab774e38d020d0f8ed7131bd94bd6203377f9d0fef5204d5
SHA512c40051e433c64ee39f9910c39fd6c0b77e4dbc63882634b855d751e79564e0b86e27ef7c84ff6587ed52c13418f2e184881be160809a3d0ca9eaf81518752ce7
-
Filesize
1.8MB
MD5fce4c3ebb03940314b22c5c00b9fcb73
SHA1a5b4cf7f5054e0f1adcd9923ebb9cb0c01ed4ff8
SHA256347273904c34db15b5e23c28ecf46cff86ec25994447a0699b8d6d44c631c1a1
SHA512fe42b4c6297bda11e435a49f6ab49c09ab61504b01ceebfe93c9d4d37065b2cb75a8e7f98f39678a9fe7c2945143ced421e7ca629e6cdc392ec9a39674dc95b6
-
Filesize
1.4MB
MD59e1e0ffaddc61fa0f542eeddb4e7d600
SHA1ba664f7c23dca0e97a7dc9aa067820a66e1be558
SHA256c4cb5f67113190c9b8544f8fac9cb6b7a83093fefaf7408d78d1c4f5da836e48
SHA512add9a939f576b4728046eb20bc48320ea88360134ae2499d641b641bb731b9c0089b717ec1d8ee72f8d7408e0c71d2ef1c8c64514c5112239902b707986f9e8e
-
Filesize
1.8MB
MD57cfbbad75e2346188b4ad1b9ec0623a3
SHA1374076020148e282a3b8a7c45d657ccef93d37e7
SHA25628da3e76ae66cf875c5d46f168d3942f81975a1a8a18bb2f3404b9aa678208e3
SHA51276c3af2cf3de68ffa93e35d765cd4493462902399e2b635187392fe8ab0d51a2d7ff83e7ba4c9b92b3dc037607e16694fa1a0a57f0775747d3b92b8870bc5622
-
Filesize
2.0MB
MD5f0bef2cc425de22dbf2fc429e937d028
SHA1a4862ed357e13bab4c162e5c8004648b088b9416
SHA25632cb2fe569de0ee681a3b0c98dd7bf21f4f86c20678f836464c698c131746aa5
SHA5122933c11e07d5eb82478337a8866425614f70d8a96dbd782f6d586b59bc7d08febabafd0b136b3bce29177c99b2589160a98dee7b856c289977283e5d932308c9
-
Filesize
1.5MB
MD517254bffff0f8f09a8a7b7c2c8f0b55f
SHA144328f0b81888129e4a4cc7b62d3144e7d750ac9
SHA25614f21e74eafcc6d754bbdede42e2f306264aaf4ad9c4fbfe57c6fbd1876474b9
SHA51269b31f33db8a45a3685ec5041ec55ea2e4017fde500a9609e41c9f59d8ab02a0ca7d0d451dfbd8243cc0c137eed5a9ca728aa902eac3fbfa3e1109031b553209
-
Filesize
1.6MB
MD59bf788b8bab7636061d8a2fa8b8ab301
SHA1811643440e51058b9f9c2ee7c6df7ded2ecbdf02
SHA2568342b8f864c2352622534e1b8011a257f279a9625ac8bd9d0e28082f5ec744c4
SHA512569ef9d4c1607b5bef7285508ea6e33d9f882e33566109392642b92da3cccb15bcf0cc4960727ce60399a09befbf86b5f70d2a6f569ec6ae3ecfcb68eacf9a63
-
Filesize
1.5MB
MD540fbca7b9815972166761c3970ecbba4
SHA1c93a38670c3562737886bcee668b161b272baa8d
SHA256592271b090efebaf3687e0690ef73d98b7991efe2beb827edfed222fb6a39052
SHA5124174d529c0de3e97943eaa61c2d1e60180f6663b1cc6022120b897f016a4e33fca416cc2082235cd6befb9ed358fff14efadf4a9c5e699138c55860d7b825d31
-
Filesize
1.3MB
MD5e7a1b58cc344db3767080e1eff0eb179
SHA19bc078aca6af37405a15cfa3ae247fd07fb71195
SHA25603f742f7c62eed0b1d0e83898254e59c9bdd834fe2e31a7e10a4e2422d71c4de
SHA5121f79c2db7c93d1a4169aea079a8ab833c1e52db5893a61beab05eb68b2f4feceec09150009166a8b04ca3fb6b1a22976ca88192b733f6c45513df5817ed55562
-
Filesize
1.7MB
MD53273d4b6b5dca4757724b9a836b0ab03
SHA1734b4520d1737ec844e739ed11d36044e8c1930e
SHA2560e9f880bd682c721509953823af3fd17c37217cfb8e7f276e47a974dae4ef497
SHA5127c2f806f8ac40d7cc45de07987124084cc35e4d3819cdf2321c4463f3961dd11049dd4d75f350f22a99811fcf8d1aa1bac1e6b23057212c14fb89a9302e7ae88
-
Filesize
2.1MB
MD5b4f8c81c76442772c9c66d6efb9f780b
SHA16eaf44da95d6ecdc869417cb4d9a47cb6b4fc55a
SHA256c3d658c00ab4ca5c600781ce80e2861e994f1a98baf9f8ca0a8f1a6a5cdd9b42
SHA512ca41cc4dec45cfe4761124566e3f8409a99d969463043e4c6a78721afeb7b9ff00522e3983989f5ec536efcb934aa7059246f0ad34240bd7af308afc85461680
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
27.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
27.0MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB