Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/06/2024, 06:56
General
-
Target
2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
-
Size
3.8MB
-
MD5
68a0589b6a420dc837ecf367be679674
-
SHA1
2944341c9781e46655ada59e5489401599a885dd
-
SHA256
07f71b4324bf652b56e84be9da5ec87831a08e1147389a50d12c69e5c4788ba0
-
SHA512
6b18112e4266f4f12ef0e5fa7767cc6ec43e612870ed0b80f9cf80158bbbc0636bf4a54b547f20393ef9d8b0d7d75a0cd8f373fc68ada0c78d3bac0791226a52
-
SSDEEP
98304:2E6tkd0I13Bqzr+lnAv+cKNa+jwCBy7VHBeoFyf:w80IZQP+lAsNTwCBgVHBez
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\TestMSVCR.exe"C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\TestMSVCR.exe" (null)2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD528b65b83aed804ff3b415788996413c6
SHA1618b93403c92aa91830ee09154f1e0b2dfeb1b21
SHA2563ad83ad0c34de8a957d9077d8ec1f0e0d2561c3778849dc1d5ce41d6a133c029
SHA512a0db177f0c656e47f08da60d5b1084bc1dcd232efd7e28b90c073ec350fae2ab80feeb11f779e184e8d6938d6d14a19b4b9e2da9eb8166d6138acfeafd4a92c3
-
Filesize
1KB
MD54b7d39c14b61d6e3bbc217357e18969d
SHA14b3f71ff73537c57ace1261f7c8e43978b8a2d17
SHA2561dd534e5d4194a7878e81ab5f736bd5591b832e8bdb235d62c09f4c33213cf3f
SHA512ce90135602608102bc101ff9232601754e5245f9e78ee209b8df00067e6cd25645db41bae17200d8fce43b3de6825acfb32d569f3a6471e3cbdcfff083566c05
-
Filesize
48KB
MD503c83a8a1bb1a48a0e37a310a8d893f6
SHA11360e8610e902469c97003bf51a7d8603d4e2b26
SHA25668a8e155fc0ff76fd9cbcb7127fee286f3216d9c28779c45861948c57640dc74
SHA512511e5534464934f26b9cc8ba206526853fb09a31b626ef5da47a0a5460ecb6941868db5de48b2597e451c4de622f19d0a7dba34b41893a14dfda8772c148fe35
-
Filesize
346KB
MD547e5db9c8990f133d57c564c20668d38
SHA1b8d90e8922c71935c61ecaae9a482fba6c3439ba
SHA2565d14c76dbc223385f34e60391ca91475078c1fe35822bf91f825fc8196d95fcd
SHA512000608913349ce84ef8eda5f68d03ef74fd57f6a16d74cb5b0945621f281b2396535f42daac33ab7bf94317b783caec9c32edfbaffa4da56c97dbfe9ea084488
-
Filesize
4KB
-
Filesize
4KB