Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 12:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe
-
Size
5.7MB
-
MD5
0868774d2473fd075d9dcd68b20e4ebc
-
SHA1
c34abb23606ea72f6caa8e8c45ffadc020d6505d
-
SHA256
f717b6c4fb1e9d0f0e102bab834e6976c75ecfe973fc975ae523d1517997f8d1
-
SHA512
cb1e4b2e00175d06402d8bffac6be1284f116857a604fa2387df18c9f0db2b3d6d6d1bfa0880a487bd6fa6ff2a0f143df2474ffb6c85d35d7575a7477929511c
-
SSDEEP
98304:LMMGgqTjjIMx5CBxAWimaFZJaxY+OO/KewTOiyO7NrMVW7FLOAkGkzdnEVomFHKI:LQoW58AWLaUIRewTOiycFLOyomFHKnPA
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exedescription ioc process File opened for modification \??\PhysicalDrive0 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2980 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exepid process 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exedescription pid process Token: SeDebugPrivilege 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe Token: SeDebugPrivilege 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe Token: SeDebugPrivilege 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exepid process 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.execmd.exedescription pid process target process PID 2060 wrote to memory of 2980 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe cmd.exe PID 2060 wrote to memory of 2980 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe cmd.exe PID 2060 wrote to memory of 2980 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe cmd.exe PID 2060 wrote to memory of 2980 2060 2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe cmd.exe PID 2980 wrote to memory of 1392 2980 cmd.exe PING.EXE PID 2980 wrote to memory of 1392 2980 cmd.exe PING.EXE PID 2980 wrote to memory of 1392 2980 cmd.exe PING.EXE PID 2980 wrote to memory of 1392 2980 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_0868774d2473fd075d9dcd68b20e4ebc_magniber_revil.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zip_onece_del_11491_20342_30554_17823.bat" "2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496B
MD5dcd12b64aeb60c4c75978b490cdd91bb
SHA16e9d7b991b2c647c08bf46c974392762fb0788ab
SHA256d9536ec713da50696e332554ce32dbe43690751fd10c593970d4ff0483e6ad85
SHA512928d299b489869bde9edf928921ead3ef79f1d649348a52481290117b87b8ed0ab1fb404aee1c1a029b25835982ea9314afae7b2bebc562a0e66ef98c00fc610