Analysis
-
max time kernel
28s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
24/04/2024, 12:33
General
-
Target
2024-04-24_a5fa47a0a605a1b31bbad544fe7c968c_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
a5fa47a0a605a1b31bbad544fe7c968c
-
SHA1
958c00935d451cde181348c66f6bfcc13799865b
-
SHA256
1f6bfb5629e5493cbcb1e5310d6a96df4a1807cfb777d5eaf9cbe7c8adfc0dc0
-
SHA512
e91e0369019ddf921de18ef372c890e0cc1fdafbee80aa70524f84ea9b9a1ffee738e90ca6d4ac2a6804eaa60e439553e56ad5ec23bff4bd8ec72f1d79c3eaac
-
SSDEEP
196608:YP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1OpZH2SAmGcWqnlv018/g:YPboGX8a/jWWu3cy2D/cWcls1B
Malware Config
Signatures
-
Executes dropped EXE 18 IoCs
-
Drops file in System32 directory 20 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_a5fa47a0a605a1b31bbad544fe7c968c_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_a5fa47a0a605a1b31bbad544fe7c968c_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD57d056f828a93c4ddab8fa270e79ee0cf
SHA1f940f77e1261ad0f96f7e8532fd9b2a1f9f76b3e
SHA256d63a8c995cb8619f185df5dce16db38526f212ea7bf19bb93425480369f8a3b5
SHA512273544e24973413248add4a43790dd0079971a5f89220419eefe331f55dd999b7656b96ef61e2afe80978c757cc0bde1fad7d68164ded9fb52435b4cf5e23d47
-
Filesize
1.4MB
MD581eb5e5283c27fc58b6549a4f6f522fe
SHA1ecc08fd2b84fa594c620968586b7e9e045fd33d9
SHA256031865d7dcf15bf91420352083abdb85c459f2b21f4fc3fa883f5ca096c38f49
SHA5128a71684054c3b9de777293032d39c655890309d543f78ec79d4d1bc6ffe948e12547b9a5ac680355069e42ce17ae62da04c4cdeaf217b226917668232955a1c9
-
Filesize
1.4MB
MD559f48df23b615b6990f73f096c1fb0b7
SHA1a75a281158a496998db0c847aa3bc700b3a353bd
SHA25648283b1406a8c3248950cf759c3c684f20e66945f0f2763e5be68061a41bd92b
SHA512d66e1cd32c8746f969e7174c872d0f78daaaec560a24a38c2a955d44aeb9106e5c597579f120a7cfab14a24ff717d855de6aa3304477585d2b664c70c385e289
-
Filesize
2.1MB
MD574a0db207a1ed6d823ae66b9742d8389
SHA1bbd781ff2874038034ee874deb7a88291636b71b
SHA256930f36e2d8bdeede67909615297110c51126db7aa8a1cbd4a40d98b657a1d324
SHA512f3d2adae7fa7ad883da13b346232eda0834fe808765ca615d45f6ee662885702e66453efc27c2b10d4ad051950f1f2674372c2cc577b604203d6c03866d63c91
-
Filesize
1.2MB
MD57f2cc842543d9c1385c95195a5fd334f
SHA1d080c680bdf5927210ef43712bab4045ee148856
SHA256b83369324669b3e3586bb7529e2c020145aa344d135f07809db6fad2a8024274
SHA512044da721cc4e2312665e3fb83afcd93a67397c42e1583f21a3603e43f3c111d75c5ea6c76814e3f92ae5ece0dfb77a58793d8378d77d143b86da0cb139125f27
-
Filesize
1.7MB
MD53fd9479408f5ceb2efe3f4fc4bd955db
SHA179687f87e11cb99d5e5518414b79f238bf7ff6cb
SHA25650f73027b82bd21617ac08aa6168c774dcdd7aa7b03b0c8efe5bcc96e6e56c43
SHA51228863d77ec526c5c1d59e9dd7e8a4b1b7c7ccfb50fc131f169e2bd11ebca1cf49e010a841b399c62a88aa6414efc94d877b088c2d60c8f07772545c9d106d1ca
-
Filesize
1.3MB
MD50f69e99dfbc4a0f1af8021f31cd2f8b8
SHA15fd5aee6d121b245754b4e567f525ecae12ff8df
SHA256738144afb9ff449eeefac7b2ca833afa9f5c9fc24a9f970637e42ff574b67564
SHA512519290c59bd5158dee3777a1ce0f44947a7f70c3779d4291a05ac4a86bf1fc771daefc365fa5ef36e2384f30dfd8d37a813774208e90cd7ba7d444a8aa2581f0
-
Filesize
1.2MB
MD579a4a3d68e130030c810c9b2ce255069
SHA1ee859089022adcb41d96727a29cf26e3720a6f98
SHA256e5ca6335a99efdbf976e9eadd40c75f5f8ef454116f6be7d773503ec647a1bd4
SHA512b1912126fa0eda1a8d9b5f0158e84ea958d7d353dcbe69d1d13e589c00fdad8b06f0fe620e5aad79e99cae7c13cd04dbf8b219e0f7b8f0ea41a7968ae4c5d5ba
-
Filesize
1.2MB
MD5eb51cb5e935a011b0181f40df922ef31
SHA1c1d7e75854a0086bb6305d1d7176e18d8937198c
SHA2564d1b8cecadb92f5a3ae1942bd6046f3997a737eda5864d47a744042d1c9cce89
SHA5123ecc535b688ca6c75d84e6585c184908a819deb520acfd0052673933528a43f96f6b6cb4eb5f84e993e5076751b29d9728e5febe533b396181cd01a3c67f7212
-
Filesize
1.5MB
MD53155012c39494400cc264cb737aa5a5e
SHA1f15eceb510dcd4aa1bbfac1ee35612f5f0282102
SHA256a9fe4d401ea5e7c894fe72e681c92841afdc1b3c4bd929a092364be44c29b5e0
SHA512ce9b58cc46e91504629cc32f5993b42b20c6fe58aa9da0ef1f4481d0c86581022b8e6f1e861fd85696d724ebe6d782f7aa44080a1efbd414cf07deacf14f32b6
-
Filesize
1.3MB
MD5ffadc167086042f25837ca9c5d1c6f3d
SHA173807ecc6bccee9eaa2d71356239dc561bff05e2
SHA256db2c84f84de92ea12dab31d88fd8dbc6ac44856cc2c0d9e0fc17c1912e989279
SHA512dd748de25a9c0702f22027c98311b771ccd06170cc3331b895fac4378f26b7b33140ac584d4894f08bf2ede5c99897b203205185f1d15c8cef9b4cfe0b7c67f4
-
Filesize
1.8MB
MD5484cb9e5033383891e7bf83ea452c8de
SHA1ba038fd9afa19d2c9b444befbe68099a1e694112
SHA256d0d15ed6ac092cca6858b708cfe93237f79bbabed6702c09f2589a6d3eefc510
SHA51244146c4d4fa6117f5649f31bdb3f18acf35f666415b0a6a185a0b180b6528a30e1e8662f0081e0f530437ac63573cfb0f5ef01d0bb56b3bc13b020bcc70fe328
-
Filesize
1.4MB
MD5ad2bdb3ff508149c8137e4f77c0c02f0
SHA1c95c64a0be0f23e40bcd9f497a9913cd9b436272
SHA256dc09cbd9f20ff0a0711c61b477c5f66ca91af7c5c33e377411cea9fad2d2cbe8
SHA512c268b5cfd9ba3a2bfb46f4761c479f644d00b46a42d44186ebbcc91fa9d7dabc2f20dc123e37d8d331c60d5e26b5399d470258db49805c84467db9e33ee2e912
-
Filesize
1.5MB
MD5dc34d9bcbd1331708e88bd73c32eade4
SHA1e74fed240b831fd688d4c63d51d0562acea25333
SHA2564f35359bfff58be375ed35b2b7ca7fac0e510d3ac689b764863682b47aa419a9
SHA51225b2bd05fc008e90eedaabbc669c4038bb2e3cc0caf45a9fe9b6e885665a4638854ee20cd5337fb49201fe27773f393d9ea0b126e6e2dfe0259828535d347b1c
-
Filesize
1.3MB
MD5d73308191bb457e06ab250fbc7346e84
SHA13a393dadaee60b02b637445644fdc98074ab12dc
SHA256ffbf89c6622d6c2e6233a58757f7cb623ccc87dd780b5941cef5a0eaa2a5ac4c
SHA512bc9eeae310b09cd5567dcc6a3e827dc9ffe9b662108a99d910aa802a21a478d323eab037cc81174514c76d72eef643f74bc98cb114ffa5df40b9c0fbfc5de15a
-
Filesize
1.3MB
MD5bb714e1d087e613a82002e006333cdcc
SHA19d45086546bf8e3e7f7f879bfa1e9232b26cfb92
SHA25666dab60f6dec3328187f3a46b845c1a359b27fe9d2be2829f28a9fb7a2395869
SHA512273996083e6ebdba32a4e53dce29aca9f8e17f93673702dc5a8da89bf0ea993e0f0a1b5037299a27064ce131d9719f0f441193bf82d274ab5739180b4963d2f5
-
Filesize
1.2MB
MD5d7b8b06b1e22bee136c31a5a5db1e4f9
SHA1f368983f137db82c1b68a30dc159ee0397188667
SHA2568efb89193e32cdb432afae2b1ab1b4231069d19e527570b43503ec21a55167f0
SHA51215993a9759e980c6d27d63a10065bec4e783b5d39e2afd42bcf8bd1ff47eda22edd533ccd58111cc630bf2642453c467f78817992621d4611354ab239cf13b46
-
Filesize
1.3MB
MD5abff8e6048d3ad4d7cb2f3a3c011935f
SHA1636fa07ef47c2d6ea128b224b721c633cb6a11f1
SHA256c07a5dd3791d8e8c76d46f7d0417970e9463190ee133b9e35fd8ca10afc1ef3d
SHA5123c1dfbbe2afed29aafeb4d964fa4ceba8f62f91ff7a90089bd609e1784613e3e212f38883375ff17c809ea3ec187b0b25b23e957f1e0c96912be2c771cce57f8
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
27.0MB
-
Filesize
27.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB