Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 13:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe
Resource
win7-20231129-en
General
-
Target
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe
-
Size
10.1MB
-
MD5
51d5200e15ebda388c63a38a0d0105ff
-
SHA1
085e836dd0adb10f3cc7a80270ea729626c32076
-
SHA256
05e7c78141093b0ca5a02cfec727a5ba40002cc731a589a098f46b221c3240d4
-
SHA512
64154fc84557c4c1a7f2d764da56d5be3250ec6a9bb9ce2124301fb01fe1e5456b0628ea243775b9f1b1c091763a33fc0d4ed770eb1c61efbf8d5e28fbf5f9a9
-
SSDEEP
196608:kdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:AadCoXrlAJ7N3pXW2uGzy
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
lite_installer.exeseederexe.exesender.exepid Process 4556 lite_installer.exe 4316 seederexe.exe 13040 sender.exe -
Loads dropped DLL 10 IoCs
Processes:
MsiExec.exepid Process 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exe2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exedescription ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\T: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\U: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\M: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\R: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\W: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\J: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\P: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\X: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\K: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\V: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\N: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\Y: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\O: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\Z: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in System32 directory 64 IoCs
Processes:
sender.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\symbols\dll\wUxTheme.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\apphelp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wgdi32full.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\shlwapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\shcore.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\WLDP.pdb sender.exe File opened for modification C:\Windows\SysWOW64\DLL\iphlpapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\rasadhlp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\DLL\wkernel32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\combase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\shlwapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wimm32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\bcryptprimitives.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\msvcp_win.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\winhttp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\DLL\wsspicli.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\WLDP.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\msvcrt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wgdi32full.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\version.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dbghelp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\apphelp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\secur32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\DLL\winnsi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\dnsapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\shcore.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\nsi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wsspicli.pdb sender.exe File opened for modification C:\Windows\SysWOW64\Windows.Storage.pdb sender.exe File opened for modification C:\Windows\SysWOW64\ws2_32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\winsta.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\Windows.Storage.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\Kernel.Appcore.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\shell32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\ucrtbase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\ucrtbase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\version.pdb sender.exe File opened for modification C:\Windows\SysWOW64\combase.pdb sender.exe File opened for modification C:\Windows\SysWOW64\DLL\wimm32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wkernel32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\advapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\msvcrt.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wrpcrt4.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\advapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wtsapi32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\dbghelp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wgdi32full.pdb sender.exe File opened for modification C:\Windows\SysWOW64\shcore.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\dnsapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\bcryptprimitives.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\webio.pdb sender.exe File opened for modification C:\Windows\SysWOW64\stat_sender.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wntdll.pdb sender.exe File opened for modification C:\Windows\SysWOW64\msvcp_win.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\wuser32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\CLBCatQ.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wmswsock.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\rasadhlp.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\wntdll.pdb sender.exe File opened for modification C:\Windows\SysWOW64\dll\ole32.pdb sender.exe File opened for modification C:\Windows\SysWOW64\version.pdb sender.exe File opened for modification C:\Windows\SysWOW64\symbols\dll\Windows.Storage.pdb sender.exe File opened for modification C:\Windows\SysWOW64\iphlpapi.pdb sender.exe File opened for modification C:\Windows\SysWOW64\wntdll.pdb sender.exe -
Drops file in Windows directory 17 IoCs
Processes:
msiexec.exedescription ioc Process File created C:\Windows\Installer\e58438c.msi msiexec.exe File opened for modification C:\Windows\Installer\e58438c.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI46D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4796.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47D7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI48B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B08.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI467A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4718.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4865.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A4C.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
seederexe.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe -
Processes:
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exemsiexec.exelite_installer.exeseederexe.exesender.exepid Process 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe 2036 msiexec.exe 2036 msiexec.exe 4556 lite_installer.exe 4556 lite_installer.exe 4316 seederexe.exe 4316 seederexe.exe 13040 sender.exe 13040 sender.exe 4556 lite_installer.exe 4556 lite_installer.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
Processes:
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeIncreaseQuotaPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeCreateTokenPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeAssignPrimaryTokenPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeLockMemoryPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeIncreaseQuotaPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeMachineAccountPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeTcbPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSecurityPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeTakeOwnershipPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeLoadDriverPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSystemProfilePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSystemtimePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeProfSingleProcessPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeIncBasePriorityPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeCreatePagefilePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeCreatePermanentPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeBackupPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeRestorePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeShutdownPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeDebugPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeAuditPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSystemEnvironmentPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeChangeNotifyPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeRemoteShutdownPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeUndockPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeSyncAgentPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeEnableDelegationPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeManageVolumePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeImpersonatePrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeCreateGlobalPrivilege 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exepid Process 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe 1856 2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
msiexec.exeMsiExec.exeseederexe.exedescription pid Process procid_target PID 2036 wrote to memory of 1940 2036 msiexec.exe 97 PID 2036 wrote to memory of 1940 2036 msiexec.exe 97 PID 2036 wrote to memory of 1940 2036 msiexec.exe 97 PID 1940 wrote to memory of 4556 1940 MsiExec.exe 98 PID 1940 wrote to memory of 4556 1940 MsiExec.exe 98 PID 1940 wrote to memory of 4556 1940 MsiExec.exe 98 PID 1940 wrote to memory of 4316 1940 MsiExec.exe 100 PID 1940 wrote to memory of 4316 1940 MsiExec.exe 100 PID 1940 wrote to memory of 4316 1940 MsiExec.exe 100 PID 4316 wrote to memory of 13040 4316 seederexe.exe 103 PID 4316 wrote to memory of 13040 4316 seederexe.exe 103 PID 4316 wrote to memory of 13040 4316 seederexe.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_51d5200e15ebda388c63a38a0d0105ff_magniber.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:81⤵PID:3524
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C6EA568D1A62173C21F69B7299F4D2A2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4D6BDF39-A8AF-47BE-BABD-82BE444AB126\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\4D6BDF39-A8AF-47BE-BABD-82BE444AB126\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
C:\Users\Admin\AppData\Local\Temp\073E2BE6-D6A3-4719-8614-F9AC146CD624\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\073E2BE6-D6A3-4719-8614-F9AC146CD624\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\DFF170D8-18D1-4E76-AB70-242D33E3F47D\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\DFF170D8-18D1-4E76-AB70-242D33E3F47D\sender.exeC:\Users\Admin\AppData\Local\Temp\DFF170D8-18D1-4E76-AB70-242D33E3F47D\sender.exe --send "/status.xml?clid=2765538&uuid=5070d918-3619-45bf-b2e7-df73bc92486f&vnt=Windows 10x64&file-no=8%0A15%0A25%0A45%0A57%0A59%0A102%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:13040
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575B
MD531d2753e55767ab2597bf531661d2151
SHA1b1f4742930cb928fc570ff273a161c844fc28d64
SHA256986593c10baf38f0aeb9a890986ac603f9c2327034d69f4292bef55b40e48f03
SHA512930fbc4aa5107a6d7a7dee82a0086f41980f7aaa82d562042884c77329c9675fdb7702b742156d26f15a6576e366ea6c434e4c105044ebf321ba4db76fdb610c
-
Filesize
8.6MB
MD5225ba20fa3edd13c9c72f600ff90e6cb
SHA15f1a9baa85c2afe29619e7cc848036d9174701e4
SHA25635585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
SHA51297e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
-
Filesize
419KB
MD5aafdfaa7a989ddb216510fc9ae5b877f
SHA141cf94692968a7d511b6051b7fe2b15c784770cb
SHA256688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
SHA5126e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
-
Filesize
260KB
MD5f1a8f60c018647902e70cf3869e1563f
SHA13caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA25636022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
SHA512c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
-
Filesize
34KB
MD5e1cb51bc98b3c4562d37252df45e7444
SHA16fbfd14b4767c83148f6415e9bae094bca485eed
SHA25616ee84230bbf672e20c36170e8f5e34c351ed0aa1e9423533ea1d2f19e7bf47b
SHA512e5a13d7217f0538ec32b33719219f91465878fa36c34e537806fb7d35e1b9d009051268928210490e29ea8d0c81e604e6c54f30965e78ec353a56c58a1006293
-
Filesize
531B
MD5c569a73140c7682adb47b64117c4144f
SHA1d894792b4dfa7c5f6e696f05fd7dfd9c3f9a2ebd
SHA256761715b9e682b75c6c41c9664263c0cddac295d4725ddf92fe267aac2fc1e54b
SHA512b30001a70cd1265f206bf0c7458791e37d7890d5777fe43ec6c901368b3788efba849ce91c364da47c9084b73382b1eccc8c3614fe7fc9d1b8155021014e46e0
-
Filesize
40.8MB
MD5dc5128fcb8d7f6b849f1166532db2dc8
SHA18427501d440d5edbbb2662294bc5650d2bc8aab5
SHA25636e682f419c2b5d8e7c285d36088b56d59df3869dbd181943280696d4ca391ca
SHA512bcf0d463ed4f01a313b8e6be745ad55b42108be84cc5850c411dec19aa7c6d996782da49fc208559f1188941bdd1082d954cfa316f08c0ad2efcf0662952e524
-
Filesize
2.5MB
MD5fefc3d677388386c29d8720c15b9db3f
SHA1370f1f40ae5c652d87b3b8f42e67d827af2b1754
SHA25674d5e8d3cd8d659d8df8e6f306832dfc252e1a6e676bb60334e31b5943deb4fb
SHA512b462ca1ffb0798bedc39c945daa75ff73e0efbb1c6dfdb262e6b2936158933f514f0b4169e811069df11aaeaebd39c826ce0caf9f6eb6d77de249fca6abe39fe
-
Filesize
510B
MD510cdb2ce3fe53937c8a0879033424135
SHA1061e1fc38f7075d0e6b40b00004225f64f046cbd
SHA2561bd0f826e60de8c54b4becd496b5f7b642ec10a3a0c4b827479c7c6e0d50ae00
SHA5124539da3e183e4856614b5baa50f54a384edf3bea4bfebade45c019a046fc2bac94734e019ac3420905707e19907241452f6b72214a373ddfd6a684dd04f67ed7
-
Filesize
9.8MB
MD5a685e7710dfd278be21aad1d88f6037f
SHA1c40bdb55e24180aeb3f94927f4ab857a10bae870
SHA2563274d31cd9e5ee72687e8fc0bd2d53e47cd61301a0a715a572b4c29fcb808ed4
SHA512fd77dc748bfbe53f871f18c3449a7ccc3c9b44a41aff4f2475f5c5a667cdfefd7231a23a723bb9599cdf884473abce42752067201d4aaf6245f65ffd4ebf3375
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kwvh0l1k.Admin\places.sqlite-20240612130339.630260.backup
Filesize68KB
MD5314cb7ffb31e3cc676847e03108378ba
SHA13667d2ade77624e79d9efa08a2f1d33104ac6343
SHA256b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
SHA512dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
-
Filesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
Filesize
313B
MD5af006f1bcc57b11c3478be8babc036a8
SHA1c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA256ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
SHA5123d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
-
Filesize
38B
MD5a1b396bc3f125a7a0b1e33e8557f21aa
SHA11a116b9ad05547e217c52f37df7f8fcf387d2128
SHA25602ba4a6e2d8037e2fed43d76d15909f8bac5fb3e15491aedc2eb6b37d15d1a45
SHA51285160da65d11c7f175ed8b2757d89d2626e0586509ca1fd0f38e25ba5e03dbc5f3bb7db78d91b9cb830fb1d2048ebd377a8b99fde7e075d9c71616d638f429f8
-
Filesize
181KB
MD50c80a997d37d930e7317d6dac8bb7ae1
SHA1018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA256a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
SHA512fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
-
Filesize
189KB
MD5e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA16a1b7f1a45fb578de6492af7e2fede15c866739f
SHA256669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
SHA512fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb