Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
30/04/2024, 11:53
General
-
Target
2024-04-30_9a2cea83f2fa842a1f0ec23f45304366_magniber_revil.exe
-
Size
35.7MB
-
MD5
9a2cea83f2fa842a1f0ec23f45304366
-
SHA1
4dead163187bca6cda8cb5041d15105e2ea10d00
-
SHA256
1d94c15cc7d2b3cc3bdd8422b2bb271eff00d07cf77ddcb0cb445ee751784cde
-
SHA512
59b2823a9d9b1d63859eff6952ff4f02faae9467c808c94eac82be6a9dead60d33884f363ead26422cb4b1cd7f561e2364a40b9167847a8e7b4c44ce50d9c326
-
SSDEEP
393216:4HUaysP+F1gBJ3gDjHbSaiAFStsZTBuSgCh9h8hAqsPZ/U0qIpWerqNNZifKl/hf:UUaa6BOLiATZgC2hAgZiG/s7g
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Downloads MZ/PE file
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_9a2cea83f2fa842a1f0ec23f45304366_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_9a2cea83f2fa842a1f0ec23f45304366_magniber_revil.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Loads dropped DLL
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5c8bb69be701cc89e717b0044d810138d
SHA125eb14392b98037b052d667ef4cdaf918229649f
SHA2566c7f4c39068458eb3d716b495738747267d7edd5afe89883d961c2010e73cd81
SHA5126bc96fd07f857ce600d7024b28c2259865aba6742acfc958ae3216320209e5da035a3e8120f7658d153ab349d88a57bfa834334ce5637a52bb7165ab152e1612
-
Filesize
600KB
MD5f637d5d3c3a60fddb5dd397556fe9b1d
SHA166f0c4f137870a9927400ea00facc00193ef21e3
SHA256641b843cb6ee7538ec267212694c9ef0616b9ac9ab14a0abd7cf020678d50b02
SHA512e96984f2f9c6858e989f10fd8e71b09a8a640c9be2fb87ac1692d9bca7107d7a837f8fbdcc46c01a6107dd9020994c5a6f975b7e16434e9b2bf1c43b1f0d8b31
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB