Overview

overview

10

Static

static

10

2024-05-11...xz.exe

windows7-x64

9

2024-05-11...xz.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2024 12:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-11_571c4af4cedef9b6d90dd0c125dc15ae_magniber_zxxz.exe

  • Size

    5.1MB

  • MD5

    571c4af4cedef9b6d90dd0c125dc15ae

  • SHA1

    9b93f2f375c70d7f65453a6c2a19ff02642b01e9

  • SHA256

    7109dad9bf6b84cd5f7726c0da2b14d874c406ba7b61615269e8c0c8d0993814

  • SHA512

    b96bd93d05d45e20665513ac8fe90f3a8eff2a1e9c350dd869b0c8fca99f0ba38e935db97f198f2bdf31dc9d8a7aab8147f48175bf785f3659f621e8e4a53a7c

  • SSDEEP

    98304:RQvO/XAnnXrv9qCUI48Kbnk48LRYJ5wk4r3z:R76nXrv9qCUI48W3O

Score
9/10
evasionupx

Malware Config

Signatures

  • Detects JavaScript files used for persistence and executable or script execution 1 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_571c4af4cedef9b6d90dd0c125dc15ae_magniber_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_571c4af4cedef9b6d90dd0c125dc15ae_magniber_zxxz.exe"
    1⤵
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\index.hta?utorrent" "C:\Users\Admin\AppData\Local\Temp\2024-05-11_571c4af4cedef9b6d90dd0c125dc15ae_magniber_zxxz.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\index.hta.log" /PID "1416" /CID "woZ5UsYByFQm8IQZ" /VERSION "109946050" /BUCKET "0" /SSB "2" /COUNTRY "US" /OS "10.0" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-1337824034-2731376981-3755436523-1000" /CLIENT "utorrent"
      2⤵
        PID:4832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 1420
          3⤵
          • Program crash
          PID:2808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
      1⤵
        PID:1260

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\images\main_utorrent.ico
        Filesize

        104KB

        MD5

        44d122c9473107fc36412de81418c84a

        SHA1

        a0072c789a9cd50ba561683c69af8602927cf4a8

        SHA256

        7c7279daebd88f6a34246603db9c0ecf9bbfa35ef820edd3278e5bc53f9e7680

        SHA512

        b4294b80edc0566744dd98a5ab3e2ac64a4ce4851192d5610ee13f12dc24947f51b7d5b5629f7bff6004d74e5a2b728913cda1b3386cf878ab7fb365490d8067

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\index.hta
        Filesize

        522B

        MD5

        76903930c0ade2285f1ab1bf54be660d

        SHA1

        0fdd5990ca58cf6c49985ffd2075baa09cd728ce

        SHA256

        61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e

        SHA512

        c66c7f9f488a0ac58fc1b7c6560edb4bc6df71a3504c2567ac54f4f89aee40a7073865e67e508baf4e055555bbc2f461d5b558a427ab6ac602b9fe0b1f9f8c71

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\install.1715428876.zip
        Filesize

        761KB

        MD5

        a65ca84bf2c878f87206ff596142b062

        SHA1

        8998ef455e40d8d1d0d903369ac832a7afd7fc1e

        SHA256

        68e37eed2e04830fce9f735d8a2ecebb19a651394f5d590581370ac5d7754d90

        SHA512

        bb87190b55a2192b0c3dfaecc26b5e144ffc021fe45e70baf48788ea687511cf53b5851d79b95b85841257293271e2eaab3cdc0ff0bea401127d9172e5d75ae2

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\scripts\common.js
        Filesize

        354KB

        MD5

        294704ab62d0810ce15a39d08c8b1bf4

        SHA1

        9eb74fbb3eb81e6312c94ec4e3e84792e1a0aa68

        SHA256

        f6332951011366de16da034680ca2eaf06d28171aa094ed42af649823b045bdd

        SHA512

        a622b8109a5b09961dd18761abeb701b3a2956967a8373e1ea3e4648a5a0d7427f37b7d0f0e3635aad452f43d0754d30ddeeac5def88a554ad655f174d60faff

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\scripts\initialize.js
        Filesize

        1005B

        MD5

        2a65c76b51a2c15eebeefa662d511af9

        SHA1

        3c5f93d39fdd573e43c7a451836d425bc1b07a5d

        SHA256

        31fc706ae4bd5093aecb6a0b7f9d3b686feb284076b1122aaff978779612dc06

        SHA512

        85b012dca5bbdbdd929de859ae41ed817c7f1e02eae70aaaf687f9ba381f696fa7751e3f2262d48c14f49c9090f106a6bb9652962d38bb7fab93214a2466e8ed

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\scripts\install.js
        Filesize

        6KB

        MD5

        ade3e833add95bf0f5f1619bf816d893

        SHA1

        48df3ae9a43c6d8783dab68ec423a9ff8ab25c04

        SHA256

        bbbf5859eb80eda10d42aee0557256d161768f1db7648f65a12444fc40fb8f1d

        SHA512

        8ed6005f9801ad5e7108ca698f65f7e31ecd842ca3fc9c1086f9cd247896b2ed59c8d5aaf62ad33e96e67837757814510ce058b5ce1cbdec461453799f9abf26

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\HYD4C7A.tmp.1715428876\HTA\styles\common.css
        Filesize

        99KB

        MD5

        8a94d780401556cceabf35058bbd4b5a

        SHA1

        19ee91b1629f4ccf0fca1f664405a1eee9dacc5a

        SHA256

        086a7e44de35a235bc258bf1107e22a7dc27932cb4d7e3ebcd1f368acc000caa

        SHA512

        b02fdc9b46f6fa8424660f462bb290c60c0635ad5cb9fa1b386a55d85d4368d06ae5611d355f8dc0db76477c2e332b0501e70cbbba77c45aa027e1cac59ca182

        Download Submit
      • C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat.old
        Filesize

        7KB

        MD5

        cff1979de4367b371d57feca3efdbcf6

        SHA1

        4d4e58cb25c8f9e7915ace61efac3d878edbdaed

        SHA256

        3b45e835d6865d17d5d17891fd9c428291c309e61652fd3aa12a5f3bf641e88a

        SHA512

        b17a42bd93b02521765580ad5cca038ee75515db621c448f119055c6ab8af802eb6058660b92a661fd47ad8fd3d87f454418de96674c730699617a4e52a832f8

        Download Submit
      • C:\Users\Admin\AppData\Roaming\uTorrent\toolbar.benc.new
        Filesize

        170B

        MD5

        935e5782c51bf8ba9191f70dbd01c5bf

        SHA1

        e1007b639ca90b3969cc00c2fd36fcc1a8056d2f

        SHA256

        af02c7dc1b666580ba7cb28e68ef8f7c394a9caa3542c8b49278eb12f7f13f3b

        SHA512

        25222b24ec8acab859b2173be42330dfe8da54c94dcc3d98298a63c17de5f952dba05aff8c9105930d737f535a93ce52e0f6e46df70ad495836522842bc27a1f

        Download Submit
      • memory/1416-0-0x0000000000400000-0x0000000000921000-memory.dmp
        Filesize

        5.1MB

        Download
      • memory/1416-86-0x0000000000400000-0x0000000000921000-memory.dmp
        Filesize

        5.1MB

        Download