bb1f602e32e78d69ba2b93f7ce3a849446c27b95a10b943c6ab9c5488f7c81df

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe
Size

6.8MB
MD5

8cfaa746fa174e8f1149e516819ba512
SHA1

d24b68cfccb04e38d153db6e677aab33470d7f4e
SHA256

bb1f602e32e78d69ba2b93f7ce3a849446c27b95a10b943c6ab9c5488f7c81df
SHA512

752106b74276d12d702203d22e87e5a9caaafa0563da36daffd27c19425eef7bdc539bdbbe8735620b609748797bc434661ad91506ce2d6120efb790c7e29750
SSDEEP

196608:uIFAQlLAut6bMxDD0pMy/VVt7KPrixivFLOyomFHKnPUv:uI3L56bMypMH0ivFf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\UDisplay = "\"C:\\Users\\Admin\\AppData\\Roaming\\UDisplay\\UDisplay.exe\" daemon"	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe

Executes dropped EXE 2 IoCs

Processes:

UDisplay.exeUDisplay.exe

pid process

2380 UDisplay.exe
2524 UDisplay.exe
Loads dropped DLL 2 IoCs

Processes:

2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exeUDisplay.exe

pid process

2844 2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe
2380 UDisplay.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

UDisplay.exe

pid process

2380 UDisplay.exe
2380 UDisplay.exe
2380 UDisplay.exe
2380 UDisplay.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

UDisplay.exe

pid process

2380 UDisplay.exe
2380 UDisplay.exe
2380 UDisplay.exe
2380 UDisplay.exe
2380 UDisplay.exe

pid	process
2380	UDisplay.exe
2524	UDisplay.exe

pid	process
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe

pid	process
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exeUDisplay.exeUDisplay.exe

pid	process
2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe
2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe
2380	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe
2524	UDisplay.exe
2524	UDisplay.exe
2380	UDisplay.exe
2380	UDisplay.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exeUDisplay.exe

description	pid	process	target process
PID 2844 wrote to memory of 2380	2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe	UDisplay.exe
PID 2844 wrote to memory of 2380	2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe	UDisplay.exe
PID 2844 wrote to memory of 2380	2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe	UDisplay.exe
PID 2844 wrote to memory of 2380	2844	2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe	UDisplay.exe
PID 2380 wrote to memory of 2524	2380	UDisplay.exe	UDisplay.exe
PID 2380 wrote to memory of 2524	2380	UDisplay.exe	UDisplay.exe
PID 2380 wrote to memory of 2524	2380	UDisplay.exe	UDisplay.exe
PID 2380 wrote to memory of 2524	2380	UDisplay.exe	UDisplay.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_8cfaa746fa174e8f1149e516819ba512_magniber.exe"
1⤵
- Adds Run key to start application
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Roaming\UDisplay\UDisplay.exe
C:\Users\Admin\AppData\Roaming\UDisplay\UDisplay.exe main
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Roaming\UDisplay\UDisplay.exe
C:\Users\Admin\AppData\Roaming\UDisplay\UDisplay.exe daemon
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\UDisplay\UDisplay.exe
Filesize
6.8MB

MD5
8cfaa746fa174e8f1149e516819ba512

SHA1
d24b68cfccb04e38d153db6e677aab33470d7f4e

SHA256
bb1f602e32e78d69ba2b93f7ce3a849446c27b95a10b943c6ab9c5488f7c81df

SHA512
752106b74276d12d702203d22e87e5a9caaafa0563da36daffd27c19425eef7bdc539bdbbe8735620b609748797bc434661ad91506ce2d6120efb790c7e29750

Download Submit