Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
25-06-2024 12:24
General
-
Target
2024-06-25_218fd2cd5ba7e0223bd1e321df32318a_magniber_revil.exe
-
Size
5.7MB
-
MD5
218fd2cd5ba7e0223bd1e321df32318a
-
SHA1
c0bad69ee11a00362aa267b27742c3f4d03732a4
-
SHA256
864cc6760cdbd67b090e615b4ab320fb10f3f9f43905b42410e9a5ad224e355b
-
SHA512
bd9703175a602f5882bfd0eff32c794ef6817851b6bdb7ef3decf00135434dca17a8c82fa7cb53eff022596678b83ad5daa35666f4240bed6a328a9ed6b7a305
-
SSDEEP
98304:j/6n94bDY2EBcBuq62V///4nAWakrn7S/IhWoaVVfs/VIsMF4JD8iulhq7NmCkVK:mMD+cpvJ/4H3nmghWoa/fsysMF4JD85o
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_218fd2cd5ba7e0223bd1e321df32318a_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_218fd2cd5ba7e0223bd1e321df32318a_magniber_revil.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
650B
MD52962ae318518054184545caa1706a319
SHA1f9c8ae4842c824ade852621bdd48389477faf2e7
SHA2569b26ed7564ea9e2351d4ceb5fb17a345656200649d93bd156edf93d83818782e
SHA51256f1c03d066cb87b18d6b3621eff5a7002a3117787810b94c34594723ff4e1c369e68ea2722503934ba0204b8b5c58f169c226a483bfdb9058f18427e9e65a2a