Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 06:56

General

  • Target

    2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe

  • Size

    3.8MB

  • MD5

    68a0589b6a420dc837ecf367be679674

  • SHA1

    2944341c9781e46655ada59e5489401599a885dd

  • SHA256

    07f71b4324bf652b56e84be9da5ec87831a08e1147389a50d12c69e5c4788ba0

  • SHA512

    6b18112e4266f4f12ef0e5fa7767cc6ec43e612870ed0b80f9cf80158bbbc0636bf4a54b547f20393ef9d8b0d7d75a0cd8f373fc68ada0c78d3bac0791226a52

  • SSDEEP

    98304:2E6tkd0I13Bqzr+lnAv+cKNa+jwCBy7VHBeoFyf:w80IZQP+lAsNTwCBgVHBez

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_68a0589b6a420dc837ecf367be679674_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\TestMSVCR.exe
      "C:\Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\TestMSVCR.exe" (null)
      2⤵
      • Executes dropped EXE
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Tencent\SoftMgr\SoftMgrInstall_20240609065607.Log

    Filesize

    3KB

    MD5

    28b65b83aed804ff3b415788996413c6

    SHA1

    618b93403c92aa91830ee09154f1e0b2dfeb1b21

    SHA256

    3ad83ad0c34de8a957d9077d8ec1f0e0d2561c3778849dc1d5ce41d6a133c029

    SHA512

    a0db177f0c656e47f08da60d5b1084bc1dcd232efd7e28b90c073ec350fae2ab80feeb11f779e184e8d6938d6d14a19b4b9e2da9eb8166d6138acfeafd4a92c3

  • C:\ProgramData\Tencent\SoftMgr\SoftMgrInstall_20240609065607.Log

    Filesize

    1KB

    MD5

    4b7d39c14b61d6e3bbc217357e18969d

    SHA1

    4b3f71ff73537c57ace1261f7c8e43978b8a2d17

    SHA256

    1dd534e5d4194a7878e81ab5f736bd5591b832e8bdb235d62c09f4c33213cf3f

    SHA512

    ce90135602608102bc101ff9232601754e5245f9e78ee209b8df00067e6cd25645db41bae17200d8fce43b3de6825acfb32d569f3a6471e3cbdcfff083566c05

  • \Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\TestMSVCR.exe

    Filesize

    48KB

    MD5

    03c83a8a1bb1a48a0e37a310a8d893f6

    SHA1

    1360e8610e902469c97003bf51a7d8603d4e2b26

    SHA256

    68a8e155fc0ff76fd9cbcb7127fee286f3216d9c28779c45861948c57640dc74

    SHA512

    511e5534464934f26b9cc8ba206526853fb09a31b626ef5da47a0a5460ecb6941868db5de48b2597e451c4de622f19d0a7dba34b41893a14dfda8772c148fe35

  • \Users\Admin\AppData\Local\Temp\Tencent\SoftMgr\~f760db7\dr.dll

    Filesize

    346KB

    MD5

    47e5db9c8990f133d57c564c20668d38

    SHA1

    b8d90e8922c71935c61ecaae9a482fba6c3439ba

    SHA256

    5d14c76dbc223385f34e60391ca91475078c1fe35822bf91f825fc8196d95fcd

    SHA512

    000608913349ce84ef8eda5f68d03ef74fd57f6a16d74cb5b0945621f281b2396535f42daac33ab7bf94317b783caec9c32edfbaffa4da56c97dbfe9ea084488

  • memory/2244-13-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB

  • memory/2244-38-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB