Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-05-2024 22:53
General
-
Target
2024-05-22_d65a5838b4b2db0fdc22f32c40c8fa1d_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
d65a5838b4b2db0fdc22f32c40c8fa1d
-
SHA1
208b4d9982136b513f22000b70ddf731eb654810
-
SHA256
1cf148ca064acfe320873e50707bcfde6e653b6a783c432faf0d660684447325
-
SHA512
dd58d8af352857d50c91426ad0bd7909ce9f1fcc89356ac90a727aeb259fe3087282a71062743d35b86c1760ccd4fe74e304c74d074abd99ba871fb1883fb9ef
-
SSDEEP
196608:rP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1OpUH2SAmGcWqnlv018QS:rPboGX8a/jWWu3cP2D/cWcls1pS
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_d65a5838b4b2db0fdc22f32c40c8fa1d_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_d65a5838b4b2db0fdc22f32c40c8fa1d_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD500744fd19b7c3e7690b7d4772ab1797a
SHA14913b0c669523f47751e2808d2635b72f611839c
SHA256f8679a405cb1205109dcbb1dac9719759df057096fb2bb5e4d2d059966ec96b6
SHA512dc5d51a08b0841dfae8529fc4f92e84f6a2b368fb4938fe549774c67157692f1fd28260dadcfae991509d28263f533333f294357dcce037ed8fd7602067fea81
-
Filesize
1.4MB
MD56fbd4a0fa7e6b088ede0dac3c1be8417
SHA14a3ea93f31ab983dad6d9ba526038a16f6380c22
SHA2563e87939359ef44565361d5b657bc7cf17fc2f6ac5eee3be835435ea0f3d35ca8
SHA512fd7cdd9c70f00a49e67dd27874939b2132498c5308dcca13f9f374cebf1ac68c9b0022f4ad85bfa3279cd5ebce09a908b66cc7c48cc2883894607089e3c2edb8
-
Filesize
1.4MB
MD511719105d3890024563e4ec2b2857481
SHA12dda259f0030b1e6d67ce853d092ec7a5d07bc13
SHA25639df888cade15c1ff099abd69faeae86d81931b7b0eff9a5dafff0f210283e89
SHA5124c1e042cb90f16c4d9b89976187de64c5a12d1453f2b3d2fd7f786686776ae21df70ec6fac2e8a8e8479cafca0e8e882f21738a4a1b8b0c4500bbffc2ca3addb
-
Filesize
2.1MB
MD5caa18fcccf2a92998e3e9a1985c7f86b
SHA121f5b8896842b0be625633e1e7d2e83595a81598
SHA256020be6248c311590937fd8633210a92ed36ffef600081bc62e7e0eb2da0e4ac1
SHA512d77ab1f7c18664c63041be1480947d830bd9ce47b83e1d59ccb47b7c61a9d9ecbd12f65e8da5928e082056d88023b0e1b2aa35fc0ffe7070b0cc4c778be284f4
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1.2MB
MD54181c31326f4d245fde036e9e41f1b3c
SHA1ae7f561197ea618d408b9b8fefdddbe08dc529a3
SHA256d4e7d22aac71ef20b4aef5a7111bcb08f4ad8919d4a816a56c30162c30456e00
SHA5123bcf2cc56b2b154375a24d7645aef3ac0d2fc41d0cac790f2e1f1675fa651ded0c00119f30ed14157abfdad38c8f41ba1a9bb3a37cf4c026ad2dbf1eed8282c1
-
Filesize
1.7MB
MD5ce1e0ed14bac97374d454dddeccbf345
SHA1dd206143cf0312a0acf6a0c1f3609bb11db8daf2
SHA256952d27d19636b81f23f9ca35d5c56088b59d59116932d3ff1bc168659f2e5ecb
SHA5120a9db7e06b19f321812e7192ba7a07afb7f015ca846ec3ae936faa4f35b002ca33abee8929679579334a378138454e000680c1eb89ec363472ead5eccb5e4c07
-
Filesize
1.2MB
MD562854fa77cb953219610d98e6d6802c8
SHA1fa0ddcaef5262d95303824510a0d4d54f78c4663
SHA256b0d86218d6ed3340744e3935ec7376036a882dc528168bc10a18ca6fbba8c7c5
SHA512a6b9ea6d2cad1221cb10655b31b6268c60483d1908913aa540eed73ee50534f06998844d558de0106ce00c99bb54a680da7462aa4b0615fe9e446bbd6a03e5c0
-
Filesize
1.2MB
MD56abf4200de7c086fd86bf77c117c55c8
SHA1b93afe4f119f001f1b3bcfd3cc47d1b117db8826
SHA2567c095bb85b207c8d4304b044d62e45a21b2cb34e65b3738c517a4c6d605f5690
SHA5123dafb5d59bb0ab212b7cd1f46929f50382e2d48beb8141d369e6dd6c6ec010158cb348502ea36d4ed4d02ae1408497df1a06b3c1975b4b0a5b3647dc7eca846e
-
Filesize
1.2MB
MD5f2e09884e1e3d73d0daefbeca93bcb64
SHA16a4bd8f4776b311931ca2c80b9dfb939fbbda0d1
SHA256095f840b5b6bc571aeaa61ae40a3f921a2e006f24b84037efa4a22e4824bac76
SHA512bf11a6a4d6212d5faeba896cf9486c93894fcdcdc089abe0485c06f35a23915d64354490f0502b62f51423658347e203c344f47410ec341c5135dbefcb18c6f2
-
Filesize
1.5MB
MD52d7c7ec404be594469e303d902e04844
SHA17de10f1fd4a4a8e5236f24ee24b82e7c2f07d770
SHA25621bf74e25f2e0559ac9cb79b5bb063e4e0566af82f9fe46391cbce8fda73a711
SHA512ef9237826d720931d62866d7432ca4f10fdc530e92663c0759b55aedcf0b2ed3d96091c5542324779d15cf2a213e94583925be23aaa948ba3d1afa549ca188f0
-
Filesize
1.2MB
MD5c38aed9e75200164c27b26fc357b796b
SHA129938e3ba6904b953a913c646670ebd2c3bfce1a
SHA256bf9be66906907144f6b283a8e7dd65678e4f4f15054d106b24b06f1907bafcf7
SHA512503e85b3fd7746304ed17d3d3df3c7f89ec3f3e8378a2ae1ba88a3032c84782ddae18215a8c938f69ddbcbc64417175241d3216f90e67be28dd7f60c1dfb80c0
-
Filesize
1.4MB
MD5891801841950fddc1dd707d2fc68b25d
SHA17f301adfdc129cf40c7d0b889b68870fbe3df727
SHA256e7855091b2fe84883fff4ebb48afb9ceaf0dded8f8058322f73365b667be006c
SHA51219b518ff3566ace8b5feb24221e597d8fafa2a117f5204d73e474ab58c6b8349c68c98ee2e0a58b47c19de0a5eac205b2ffbb6d4b616aa8d4a3476ae4504ddb2
-
Filesize
1.8MB
MD59ad858210afaad5f014f4604bcd3b14b
SHA1fa652e549c7aea7d87d4e6bd813ca7e010473175
SHA256315ef50594513d3bc8c39ef5a386f83966f22b52a652c2f6def96b042f68df1f
SHA51274f478141b7774b481eaa664c116f1a0cab7f4c799bcd9842070a87da3c2bd0a0f83a0a036975d23075cae437d1e9b0f4edda108dbf69796a61179d2f3cb9493
-
Filesize
1.4MB
MD52a57df14761b054828d5ff91060a41a7
SHA144840ab0f836ce5b5d30b501941a07624448a4b9
SHA2561438013e76d0f787a5ac552a6e2caed95af128e9913e2818fa0ee3fe45f34fee
SHA512af60b3ee498bea5ed19815a18ddedaad69f1ad9b07a7e5424db0bd12e66ab63d5fee8e8947556eb91929319cf06abc117c62ca348e55776896b13a74141d7073
-
Filesize
1.5MB
MD502a0d85bc00675a61a4401ced2a44978
SHA1433b513880fc45cf1f54c825746b3976b67182e8
SHA256d638b05e8abd745da0c9ca78dc51af6e7e4fb889f77c3a1c20f4fa5f7ef02c64
SHA51272cb1d22f00b9a6619b3dde96a561fe57d053b016428789ef42f5453820859d7ffc6a128f18963d6694a0654982c74436fa76fad06fdc64b001da7cb0da393bb
-
Filesize
2.0MB
MD591632286c193e8d968e6fd2cff1fb065
SHA136eda54d6a0358707802e5caea2298b82eb7cb3a
SHA25613612ed46d0466e496f2ebd905d1dd1329c48769c8c2e48adb71360b7c5a7f83
SHA512bf26a52144018108f467e11997b45241c28bccf4b7310c035d4f73ffc808a68cfe6107c1112abf139223a05afb24ef0e52fc9838619c45212f047a0f3173ad8e
-
Filesize
1.2MB
MD5fc001fd3e0693cfdd731126b98ce226e
SHA1e50acb25bb635a56ab26ec7edbc3d3a36c1ef173
SHA256290cd8ba524ec2fd849ff3deb2d33c461d7538df50cc91f786b0c670da669f87
SHA512c6a1490d25afbca36362241f71280aa9b74260abfdf7bef4177da34e3f5602c6cdcb29850129aefbbb2d23a97208020930e2da0f6d2fbe1738ea7781469e0ace
-
Filesize
1.3MB
MD5722fb3160ba97dbf64bc4b778e2ef2ce
SHA15c94f1e208d8717c9a122c6da32fb366c07b5b83
SHA2569c27d4bd71a182783a49bada4b2c5be94660e70eae4f329035f64494fb91f235
SHA51253a5337fd4bf398ff66eabab61a964d3e4712309576b92b5a6eac925a9c3d1cad055ebbdfd0d962b0cf2c78b87d1b4983483aa9180aadd16b92241a14ab91685
-
Filesize
1.2MB
MD5404decb76723037db1ea13454a5b8831
SHA1635ead38114b3dd7f92b281d574f2c91e0aac20d
SHA25648d6fe6eaa87e75128d42104e38b522476f9601025c455b2703fbfd48c77a43c
SHA5126788b1b25273e4e9d86ec7675945e42e357563640f7c684269f5911025b38ca7effcccea57e448b8c5247eccb7462bb0198d46ac58a082230a7c9a089af5813a
-
Filesize
1.3MB
MD5c5e68c5122fce7c0f6617a9c68438386
SHA1cfa27d3e900ad7f09ab693609ec37b2d70d50710
SHA256223ce98b66734f54c7a8cf7fd55f076bbbcbcec06e133444e725d8bad59bfe96
SHA512df30f8d102fb97583503ee9140ab54e9aaf41878b7f95db0a079cb3223436f15a9571485b8cf08b38ec5929b1bb3ab32b1b65f21d7a3bb70e7bc78c6eaca06cf
-
Filesize
1.3MB
MD5addff70a45ad5096242ccb8c46da9bbb
SHA16f81a8ba3c47fa656cc5f5e6dd9c76a3b7e313e1
SHA2561c1101de562f83122ef9c0391b849bdd410c047376fa3ee01c6ff1ce072aee44
SHA512d5735ea2f5d507fd3a47ec2b7cc007c922a8ffd10fd0954878f4a1bff537a8ce717d3d22f2e8ad7901feb2dfb8be86fc185da000dce654f976370183594e89a0
-
Filesize
2.1MB
MD5a8a69c2e161f0884eb7b0add9e51ed39
SHA1d9039840a5d92af566d795a4ac6446112f9bb9ec
SHA25627af0dcf68e392cddc45ef5e54481383aa2d8964c6d38ad7e99db3c604cf9a08
SHA51266f42e8532b3554ccd95d933fea4ed79f4a19b5de8e29b838d85be65d07038a61d1dd3620f04bdd6d2fccb68360a52380be7b06bc4f0d752bef1be11f61a3eb2
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
27.0MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
27.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
408KB
-
Filesize
1.2MB
-
Filesize
408KB