Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06-05-2024 17:23
General
-
Target
magiciso-5.5.281-installer_UGJTy-1.exe
-
Size
1.7MB
-
MD5
789066d8f14bc09edab6684f91606563
-
SHA1
d51ea9fdae5fa021945cbd3dba2b93cb1eb2185b
-
SHA256
9636217af95da9fa67aa45daaac0e07c1c6304f358728be3025cad21e7860cc3
-
SHA512
4b24724c914f0f0b62d250a9bb5c93ff89186c5a26c5756fb03c6dfe26acb6eb3154db142a7b53212b4081ee60257e4aa9bb61de801cd3bab09ceec6f48ec564
-
SSDEEP
24576:v7FUDowAyrTVE3U5Fm6j6CnoBopu53TQqMNgYCh4kV4xKFBcRlUHmxnNF:vBuZrEU36Co6pu53Eq/YCK2I2Q7
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 10 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\magiciso-5.5.281-installer_UGJTy-1.exe"C:\Users\Admin\AppData\Local\Temp\magiciso-5.5.281-installer_UGJTy-1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MQ9BS.tmp\magiciso-5.5.281-installer_UGJTy-1.tmp"C:\Users\Admin\AppData\Local\Temp\is-MQ9BS.tmp\magiciso-5.5.281-installer_UGJTy-1.tmp" /SL5="$5014E,879088,832512,C:\Users\Admin\AppData\Local\Temp\magiciso-5.5.281-installer_UGJTy-1.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD5afaf4595c213db41f3d6e43b8069f065
SHA13a57e880eeb109c05c46c1f4826bf11a29db9aab
SHA2568d603a4f7289c550fd8420ca3772fcd3e6fda21d9f72c5b04802759a3ea096c8
SHA5120f3867d5fb9ea0b192d7ae7628578dcbe7001abf2231a09eb25dcb6a02c8c0d384817d3a97c5d8f1f936cc53696bdb0f2a1a46d16a04baccd90a8def54f94442
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
51KB
MD5aee8e80b35dcb3cf2a5733ba99231560
SHA17bcf9feb3094b7d79d080597b56a18da5144ca7b
SHA25635bbd8f390865173d65ba2f38320a04755541a0783e9f825fdb9862f80d97aa9
SHA512dcd84221571bf809107f7aeaf94bab2f494ea0431b9dadb97feed63074322d1cf0446dbd52429a70186d3ecd631fb409102afcf7e11713e9c1041caacdb8b976
-
Filesize
29KB
MD50b4fa89d69051df475b75ca654752ef6
SHA181bf857a2af9e3c3e4632cbb88cd71e40a831a73
SHA25660a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e
SHA5128106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296
-
Filesize
1KB
MD5107beb531cf7b4be928e174b7264741e
SHA15170598a1703a5ac4918cd856a1b084fecb415c2
SHA2561030d686cd9c2df5446d82cc6a1ca0b23dc6e58cffe81759157b0889aa343ad9
SHA51271156daf19be16e507629c1f9991944767aef89218501135386456aaeb7fdded3812c52a3b5edf39041438ae359a18f90819ab61d9f97334e87fb00cb9f1ed3d
-
Filesize
3.1MB
MD514a1aabbe728d1d1927183cc7ab82ff5
SHA110e4c1d238a3e7e93ab99fd2937daab57cd2462d
SHA2566754b2b8cbf9d8b6b3b958a1924bd1ddc196dccbafb98c6d26a4a6bfb7ab2d13
SHA5122ad5998fdfae6f2052fbbd144480aed4adff84a8ba4c17b5a1b7b40f69c5d9e63106690019d25ee7b3a3bd4e074fd584dce4984fa1201d04e013abc9794a9398
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
3.1MB
-
Filesize
728KB
-
Filesize
864KB
-
Filesize
864KB
