Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

2024-06-16...il.exe

windows7-x64

6

2024-06-16...il.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 09:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe

  • Size

    62.8MB

  • MD5

    ef2a6e3cfb93de64881f7fd186d8ca6d

  • SHA1

    29c80647a89583ffb16971cbf6fbf1b1eec5511b

  • SHA256

    e0ee894cfd2261833558adfdec60137cdc62db037cb1104845b5ee2c8a00a0b3

  • SHA512

    bf94f92c2e651b071440b3be70449610bb42b2e954125fd91daf3049235ab9b4fb39599e38707062cdc03bb39bd63c0aefc1631aef2bf955914d1a5bad1053a8

  • SSDEEP

    1572864:wYSh80NRJYm88Ak7qu1FU2175J+XVFzdHt2qH8kuvcEbQHz:X480d8/TKU2klldH5HBwbQT

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs
  • Loads dropped DLL 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_ef2a6e3cfb93de64881f7fd186d8ca6d_magniber_metamorfo_revil.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Loads dropped DLL
    PID:1916
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3668,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    1⤵
      PID:4992

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\curlnet.dll
      Filesize

      1.9MB

      MD5

      e15587d7d769364e990ff64c179ac455

      SHA1

      b0e10d8cd2d317932021c8da97245ba1f322c79c

      SHA256

      ef82853f2cd9c473267a051672f16c0ed78ddb26489c41dd9206460e325ec5af

      SHA512

      f8666baaf5099af60dfdaf6a187d18b040d0de03d1949f8c72c510dab964d940b3aba01c9efd209fba7bcca5758140040799025e09d56c3e22a815975c4ee260

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{DBFF26D6-A7D2-45ee-AD8F-BDC29C81CF0D}.tmp\7z.dll
      Filesize

      1.2MB

      MD5

      81799e4e4882bd26a9ae77f19ab735a4

      SHA1

      217804e437fdb651a2716a59049223fd5d8ed438

      SHA256

      df92ddec48aece5dd961cd9594ef8c6063206a768662afa735d2a977dd3f9dcc

      SHA512

      3678a35ac135040c4e9c441a2ca21c03b5bfbafc08d1109a629246c7b42d6eb467a000a8002f40f251c0b6e5f4af3ba6c684af55b9f9533eadcd6602e7c5c4e4

      Download Submit