Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
02-06-2024 07:54
General
-
Target
2024-06-02_ec9b5c1d4eefc9012f213a0bed273a36_magniber_revil.exe
-
Size
5.7MB
-
MD5
ec9b5c1d4eefc9012f213a0bed273a36
-
SHA1
82fb949ea4e9482a649b8d183c7c7113cca5dfb0
-
SHA256
742a07d39b8ccc299292e49f776ad0d2ab6c6e475b3a9801a235ff5717413c23
-
SHA512
4bcf19f9a1f9b515befcf21d66c84f017438fdf335dcebbe912162fea360eedbff82c317dc6aedd61d3bb66019ab3bad8a5dc65595dea6e86109e54c366e8bd8
-
SSDEEP
98304:b/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmPkVL:uMD+cpvJ/4H3nmghWoa/fsysMF4JD85q
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_ec9b5c1d4eefc9012f213a0bed273a36_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ec9b5c1d4eefc9012f213a0bed273a36_magniber_revil.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD524fb30e14a6b9ef4cff28e3aadde09fa
SHA1c7a5b55d257f9c8969f474543df346460c373d9e
SHA2566160357a84fa5eb132804029b42ece21d500480c9827e1ddf9115a7602551e50
SHA5121d84b6c9bb96d641486dea2d8002f873afaa2b29ea072817a5a62ae96c4c7b722930088208c00e0afb0145f7a2ea7ea7ab3e40cdd04d0332aa49a739588a98fe