Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 11:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe
-
Size
1.5MB
-
MD5
bc2aa1e3a324f4921af034533e1cd99b
-
SHA1
2f4744a5b1812981969aa628eea3affc393ce3ee
-
SHA256
8f182ac690b9b9ca1ea90c983435bb110a1e923b81538452953a34b043edaec0
-
SHA512
04988476b1453cf60dea1c8c07c15f3573806d86551978861fbe44386dba4b25fd039f088fb2ab08c7e0812b1cbf1aa8579c98d40c25156c2f823f9102e2ba12
-
SSDEEP
49152:FWUMv5De9/yG9/ooooERQr0tb6H8RlOuQhRe4/vR:FWUMqyGB0Z6H8Rl4yW
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exedescription ioc process File opened for modification \??\PhysicalDrive0 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe -
Modifies registry class 4 IoCs
Processes:
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367" 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAMF4WxROpkEuEsNNXvqzMPwQAAAACAAAAAAAQZgAAAAEAACAAAAAEajOHeTpM3LKx/ljlXz0u/VjRfMWOsD6eVmRBokIFywAAAAAOgAAAAAIAACAAAACs9SunRA/b3gBlrmxa7dv2bIf0lzpRcvWoiRBvo4w6jzAAAADYpAP2VtN1RlGLMWOQb9C6S65khgYhjrf7G9fvxycoQgTIgBZRQQNyKcaW1AnTk+lAAAAA5DPTGlAs0hNub1D/Wr1LtCFD+KAL91hxYjqZbzPDyxCiixi6EuTT7wb5ATTm6jLF1FvKqOlvpsmdIFdyswobKQ==" 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "1defd04d-131d-429f-bc06-07a69a628c34" 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exepid process 1936 2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_bc2aa1e3a324f4921af034533e1cd99b_magniber.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow