Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 20:07

General

  • Target

    2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe

  • Size

    10.1MB

  • MD5

    334e8d84ca45749879312c751ae88ab3

  • SHA1

    be93f412d63842f6d573e610e8819f1563fe1a8d

  • SHA256

    6acc7eb046aeef6f49040284e9fbf59637c5bc074bd56f22106f67d07a7686b7

  • SHA512

    3aa0db5677201ab179dc6cf57628cf01e90696bc8d33224f2ae743b50af49e3eb9f5edf2f5fed0789cbefd26c9c033b58e6bae1b5e2a372b83196d06434a9261

  • SSDEEP

    196608:Zdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:vadCoXrlAJ7N3pXW2uGzy

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe"
    1⤵
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2412
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A7C986C1ADF8FC3CDF03A5A4CB745616
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Users\Admin\AppData\Local\Temp\0A4380EF-8D79-416E-A5B7-B96473784AD0\lite_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\0A4380EF-8D79-416E-A5B7-B96473784AD0\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2468
      • C:\Users\Admin\AppData\Local\Temp\DE3E87C6-F1F8-463B-8A24-AA842EAFA284\seederexe.exe
        "C:\Users\Admin\AppData\Local\Temp\DE3E87C6-F1F8-463B-8A24-AA842EAFA284\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe
          C:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe --send "/status.xml?clid=3762839&uuid=ae40f731-C824-4D23-80B5-EC51C428f9e7&vnt=Windows 7x64&file-no=6%0A15%0A25%0A45%0A57%0A59%0A111%0A125%0A129%0A"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4132

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f761d43.rbs

    Filesize

    575B

    MD5

    c22da0256e10b754ef131989aef35670

    SHA1

    955fc88a69b4608ba72eadb4ebfc5a0b4b375798

    SHA256

    da46696ad996fbe5030f3c0d820aadab608a91de6d35686194084084c888c31a

    SHA512

    b95828087f57129b22182b5485fbd7a7968cd19b5a96e076e3075ae1609fbb69e7a55400b268c56a8ef1fbcfc7b096735745c6f3306a0fd2dedeab25ccba0282

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5398652103348c1b30cfb2167f556d8d

    SHA1

    e02188e7c3fe976d65a04fccbcd4f550275832cd

    SHA256

    ce884b127c423086517ca9edc7501ffe9d33fd32e093b5cd87956b35589afe34

    SHA512

    439f729ed4e257d582c7be1287122853a6aec8e795b66d896bbeff57a3507df8e60144b32d7a2687f77d0ddc3123a7f560bc38016e12285ba50441388e591d55

  • C:\Users\Admin\AppData\Local\Temp\Cab199B.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Cab1A8B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\OMNIJA~1.ZIP

    Filesize

    41.3MB

    MD5

    1d6cfd7db58008d1b44328c5a3a4220c

    SHA1

    8e8304bfd7a73b9ae8415b6cbd273e612868a2b2

    SHA256

    915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256

    SHA512

    4c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2

  • C:\Users\Admin\AppData\Local\Temp\Tar19BD.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\Tar1ABD.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log

    Filesize

    34KB

    MD5

    7328e816181f138f94cc1d4e890e85ca

    SHA1

    2afa28f288f61557b53d8334a22007e99141665a

    SHA256

    2cc81c91df50a3bbb095ef63bfca31a2742fe1d3d4fd9fc19f3209d005644493

    SHA512

    250c338ce2388fb1590703a33a77ca040119e7c9a753aaf18ec4b09c022bb835f5d541e4dbd495c138390760c0870faec1bc8cee4c3bcd555464910d0ed86c7d

  • C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml

    Filesize

    531B

    MD5

    37470bcda88e95eae6575f55958b001d

    SHA1

    86f83f019368c45b6a3fedde9e74682a09f5606b

    SHA256

    873d795374ca541d246c584f0ab086a027c9242c9cd77cef2407e7bbf46e352c

    SHA512

    5099ff27ee9d817976868d120bb7e92b6d650d12c4e1a0f5fbaf236e64830a271c326cbf3f70c5675e667894fb7dfef46d17a182e5619ab4fa795e70be56cbfc

  • C:\Users\Admin\AppData\Local\Temp\[email protected]

    Filesize

    2KB

    MD5

    e8b9799439990ff85d7338125796b06b

    SHA1

    e57fa8d1c65863d5e61b0b98aeb044aaf612a40d

    SHA256

    ce8f1cbe0c8d682ad7b2f2d0bb99c2179bf4ca37c69f8cb5ee1fb6c082a92813

    SHA512

    c6cc050c017a9b7b686b726ecbd77b1b1bfe22dbfdf0dbfaf8d201e8d0ef4f35bb9bf698920d131353f549f84f5fb2ea1585e6f76b39cc33684bb6f91c43ef02

  • C:\Users\Admin\AppData\Local\Temp\tmp1344aaaaaa

    Filesize

    2.5MB

    MD5

    fefc3d677388386c29d8720c15b9db3f

    SHA1

    370f1f40ae5c652d87b3b8f42e67d827af2b1754

    SHA256

    74d5e8d3cd8d659d8df8e6f306832dfc252e1a6e676bb60334e31b5943deb4fb

    SHA512

    b462ca1ffb0798bedc39c945daa75ff73e0efbb1c6dfdb262e6b2936158933f514f0b4169e811069df11aaeaebd39c826ce0caf9f6eb6d77de249fca6abe39fe

  • C:\Users\Admin\AppData\Local\Temp\vendor00000.xml

    Filesize

    510B

    MD5

    29b2508cbcc5c53473692223f2345faf

    SHA1

    130cab9a60de6c94746b5555d03533d9a517241c

    SHA256

    b54cd785c0543a209c61de0316205d5d5f1fde919a39ae1c499dd2c8683c8d74

    SHA512

    f927d54026a02e3c000c1740ff2c9a9dd1d01784f76223fff9df1dd49756a24b8582822cf784052b6d1961b727dda5099a639d334cd705476c21d5d5f36b6823

  • C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi

    Filesize

    9.8MB

    MD5

    94ac28782eb45847b7896e291958d910

    SHA1

    c3499d84b8069a911074521e62e14a5a8664259d

    SHA256

    7bc661c74be100515adbd700878cf44fec41b33838ab5bcf223062d984b5ab73

    SHA512

    c7f49a8e904fdb4f4ad1fc0631551b89b1f0e8286f82b960baec61b5ff2336c072c4788ace0c38f0a208b21b520907ff8f180c011d0dc64e92a56e051dac511e

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uu0g08su.Admin\places.sqlite-20240608200750.420800.backup

    Filesize

    68KB

    MD5

    314cb7ffb31e3cc676847e03108378ba

    SHA1

    3667d2ade77624e79d9efa08a2f1d33104ac6343

    SHA256

    b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1

    SHA512

    dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Bookmarks-20240608200750.514400.backup

    Filesize

    1KB

    MD5

    3adec702d4472e3252ca8b58af62247c

    SHA1

    35d1d2f90b80dca80ad398f411c93fe8aef07435

    SHA256

    2b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335

    SHA512

    7562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Preferences-20240608200750.514400.backup

    Filesize

    313B

    MD5

    af006f1bcc57b11c3478be8babc036a8

    SHA1

    c3bb4fa8c905565ca6a1f218e39fe7494910891e

    SHA256

    ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c

    SHA512

    3d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af

  • C:\Users\Admin\AppData\Roaming\Yandex\ui

    Filesize

    36B

    MD5

    bac4a25137c532de32448140a55b9994

    SHA1

    d135936bcb881d8e525d37883e71e3117183363f

    SHA256

    0bbe65bda54543337aaa844c6e54d4e093b622f18d6b19c3a149bc375c4b6a20

    SHA512

    90e0b3a78cb88a5d926810ae1bd51a1ce4158f081c73ddc44512d8507cba57b8f75821197e96fec86390e1435e5c7d46293db1e6804e96c2167cd47a3e6aeb8c

  • C:\Windows\Installer\MSI205B.tmp

    Filesize

    181KB

    MD5

    0c80a997d37d930e7317d6dac8bb7ae1

    SHA1

    018f13dfa43e103801a69a20b1fab0d609ace8a5

    SHA256

    a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86

    SHA512

    fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5

  • C:\Windows\Installer\MSI20E8.tmp

    Filesize

    189KB

    MD5

    e6fd0e66cf3bfd3cc04a05647c3c7c54

    SHA1

    6a1b7f1a45fb578de6492af7e2fede15c866739f

    SHA256

    669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2

    SHA512

    fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb

  • \Users\Admin\AppData\Local\Temp\0A4380EF-8D79-416E-A5B7-B96473784AD0\lite_installer.exe

    Filesize

    419KB

    MD5

    aafdfaa7a989ddb216510fc9ae5b877f

    SHA1

    41cf94692968a7d511b6051b7fe2b15c784770cb

    SHA256

    688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc

    SHA512

    6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44

  • \Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe

    Filesize

    260KB

    MD5

    f1a8f60c018647902e70cf3869e1563f

    SHA1

    3caf9c51dfd75206d944d4c536f5f5ff8e225ae9

    SHA256

    36022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577

    SHA512

    c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e

  • \Users\Admin\AppData\Local\Temp\DE3E87C6-F1F8-463B-8A24-AA842EAFA284\seederexe.exe

    Filesize

    8.6MB

    MD5

    225ba20fa3edd13c9c72f600ff90e6cb

    SHA1

    5f1a9baa85c2afe29619e7cc848036d9174701e4

    SHA256

    35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797

    SHA512

    97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3