Overview

overview

6

Static

static

1

2024-06-12...er.exe

windows7-x64

6

2024-06-12...er.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    93s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber.exe
  • Size 14.5MB
  • Sample240612-wck1fsteja
  • SHA256 24cdc7f0c20c323f251648e4144711d0348fa2458e94fa1784808a42376b889a
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Writes to the Master Boot Record (MBR)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\Temp\asw.7eb4ba69c5d3de1a\instup.exe
      "C:\Windows\Temp\asw.7eb4ba69c5d3de1a\instup.exe" /sfx:clear /sfxstorage:C:\Windows\Temp\asw.7eb4ba69c5d3de1a /prod:ais /wait /stub_context:88926bc8-37e0-466d-a7b1-2152966f049f:15154656
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:612

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Clear.log
        • Path C:\ProgramData\AVG\Persistent Data\Antivirus\Logs\Clear.log
        • Size 1KB
        • SHA256 43455e0deffe1af858bdf53577056b3b75153abcde0d24be4ac5bbca75794b2a
        • MD5 SHA1 SHA512
        Submit Download

        HTMLayout.dll
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\HTMLayout.dll
        • Size 3.4MB
        • SHA256 4682931b759eed08e06e0b4925c68e902c2731a564716b85b2b3a0d32b049e31
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Instup.dll
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\Instup.dll
        • Size 16.2MB
        • SHA256 5dd4950ef312869c5c3056397d53bdc633ad7ff793e288a21771879ab562952c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Instup.exe
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\Instup.exe
        • Size 3.3MB
        • SHA256 711e8d499fc490cbbe571485d249e483c3bec7084ca298a7158d81641b2b0863
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.def
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\config.def
        • Size 22KB
        • SHA256 1239d155068a909a1395948ce25c9cec9954e912da29a4e5e5eb347c3005021c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.def
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\config.def
        • Size 18KB
        • SHA256 b64d1d23aef5cdeeb2279216a00c931b201bce90407c9cbff3a7ef2742873878
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.ini
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\config.ini
        • Size 718B
        • SHA256 dadac1dbf6d491d2caa59cc1d0d3fbd76df94b7808565298f9e8bed30dddfc33
        • MD5 SHA1 SHA512
        Submit Download

        part-jrog2-137e.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\part-jrog2-137e.vpx
        • Size 687B
        • SHA256 354de0df08232274092f9041151a1ef7c809221aa07683b5be22c5a1bb5ad41f
        • MD5 SHA1 SHA512
        Submit Download

        part-prg_ais-18050d08.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\part-prg_ais-18050d08.vpx
        • Size 73KB
        • SHA256 4b01a68078d7e1af1c0197baddbbb1ef4d3cbf13f71e8b9df766f88b4e6d8025
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        part-setup_ais-18050d08.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\part-setup_ais-18050d08.vpx
        • Size 4KB
        • SHA256 675bd92f752a51bd7d9797895252b3130095a06d7d5db8f221ab6251735ead8d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        part-vps_windows-24052800.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\part-vps_windows-24052800.vpx
        • Size 12KB
        • SHA256 d32d1058daa6dd510801d18a43e06daef33d3f6f957fb9677eb6cd1471a99c11
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        prod-pgm.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\prod-pgm.vpx
        • Size 572B
        • SHA256 846f9f2f624c8a1f001a4bd7c7ca3158c8c79cb11fa6d474cfdf8e48d0238a3f
        • MD5 SHA1 SHA512
        Submit Download

        prod-vps.vpx
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\prod-vps.vpx
        • Size 343B
        • SHA256 52e06087d9c0968150bc5d3b06895e3ab9b69aebea20e0328434b703aa242099
        • MD5 SHA1 SHA512
        Submit Download

        servers.def
        • Path C:\Windows\Temp\asw.7eb4ba69c5d3de1a\servers.def
        • Size 27KB
        • SHA256 1fc616dd97e72451eda1324979f65df6af823aaaee1c83e5c2c3f3308cd26a67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download