Analysis
-
max time kernel
160s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01/07/2024, 09:29
General
-
Target
2024-07-01_504df0007f99f2b6c53d7169f70e920c_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
504df0007f99f2b6c53d7169f70e920c
-
SHA1
9cb405ab2d219c24133396bf9e80339b45d721bc
-
SHA256
6a6b55c75afb5f6e356b51f39012286335b6309b0efb283c2dd0116e27709e72
-
SHA512
e994823f94e5b29fd2c2b83d2aed89b798f68e818b1cc590c2e96a846336aa4f519b51a4054a4653c8d9490ec1a045b4e8ddb0b1fb2406fcf95aded789966dd4
-
SSDEEP
196608:uP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018lLiJk0:uPboGX8a/jWWu3cI2D/cWcls1QLkk
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 30 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_504df0007f99f2b6c53d7169f70e920c_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_504df0007f99f2b6c53d7169f70e920c_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5864f49fe7bfebf1980595b8f539d8edd
SHA1e39c8323b8ac1029681f6ae9084d924dccec2019
SHA25663c2a55bc226598207bbdd8c665fdc05f9951054f2d0ca89aab79855a03f273e
SHA51266c55507580bcd9d26d18267c0b6554bd74f8246fd82836464b9f60b395f44ab4cc9c173aaa3d1663624056479f6b3eef744b68b6be70c1937855ccc23a337eb
-
Filesize
1.5MB
MD50fae42283dc6b4150f5e480fc5fc058d
SHA1c4ac86cc34470d1e8a8a841017307f822ba3601b
SHA25640147999334d5d3b0fb42f3d0a9e29372e7124c3bf8498f0d4ccd70edc66b3c8
SHA512044f04fe1a84f131733eed412728bb8541a2f6349a692f772471cda9b5a5a9cbbbcf0998da32a0fb2704a5e9847a05ae6d2f3f51c0a389f68019380e8e601b0b
-
Filesize
1.5MB
MD57ffd1a1d180002e5cf1cf5489b3f110b
SHA10600727a2f37b2041423b819866f07c96cbf5233
SHA256d2db54b8fb8bbac1bc10775c51e81dfaecc257064299ed8f0dfa9af89403ac2c
SHA512bf608101630547c520a0fde29c919ed4eb0a01407b615390ed54bc68e484a0ac9beb1e1d92bd9a20083c166798ed77a7977d99da59a9c4b7947790ac33497dc7
-
Filesize
2.1MB
MD58ecaa2f5845d350a5b4c7ece4a9d4d0b
SHA1e69da3836b12c722150fd29d467b0b5894d975c4
SHA256024baa10a8813530c51afa00b6b37af0399c0315b21f236215808dc6b04b947a
SHA512901a693b106715fd49e51d3d941fa3c66efc4af2ebc9042dcf31200ca88ed7912bba8dc6b91ecc17fd1e8d1aad4bd161049b2a5632daa665a68a10c578832249
-
Filesize
1.3MB
MD59267ce771b0b0e718f987d15bb3c83e2
SHA105534b0b3e0e38843f20019456b1a73459d30829
SHA256358b681f3f7f39f7157afeeb12b0cf2edf17f42927e4c8c022f4a9e5b0ff4292
SHA5121764b4ad4a2365ea0aa0e3181ffc80411aa84e4d5e2b2e3968868f26b14fbd11ecd706228f64d2d8effa0651b1f58aa4e55647614b20c1e8c61c63cb95e1302d
-
Filesize
1.7MB
MD57f3d9a7b9bc24429db9d3085d77b769f
SHA1ff5e36d3d39e8601c766612eaa4aeea6018963ab
SHA256224158dbde34293aec5db53b4905d44571e6f36e01fa4a9ee2bee391b54b614f
SHA512a1f9aa425bb7fe152afc74ae3e93873eb07ab11895a4cd10aec106dd99672599012a652c9302649a3104094b919d5daf13be5491b81126d1888f139a3b365161
-
Filesize
1.4MB
MD5439e8f3fa402f0ded582ea7bfa0a1c27
SHA1d076268a30908dab4cb62009268664fe5ccd27cb
SHA25676c588a5daaa5698142153bfd29e1a9243b158f9eb19273171466d509ff294a1
SHA512863e2d2192f5f7ea0733a0de649f6597e054b49144783f8875b590b43ae58caa18d7c1cdf4edfd70a63c33581bdfcbd0ff42f9b690e089ad33685c184443d006
-
Filesize
1.2MB
MD597d2d149d3514bebbdba3703e99901ed
SHA1cb85ae3b2cf4db34e67a7eeb6d2754540e77e588
SHA2564ba4888b173c50e93ef9a078f32140596f041cb390eac56479a337ed7161f2eb
SHA512d529ecf109a823e75740ca8f8a9f364284fe0db68351523261532d9c51c7a0d2bad968236aeeeb8a87364773b318b38a4e514adb22e8772c0c60886fbef8c3b3
-
Filesize
1.3MB
MD509609529dcec7e0fcd678ed00c80f74d
SHA12c9cedb02c1cb1cf4c3cddc8c17d49d0c70b4b58
SHA2564c1a417cde59d1f612cd981813b00355be5e4a0046ac5a8cef66da6eb19d54a4
SHA51239c0b6a791ec3cde176f2ddf70bfd0b8b834f7177eec923a506d16d0011c9c197a1df239cc000bfd174466f20655b688016234ae19177ea5b30bbb75b78b3716
-
Filesize
1.7MB
MD565468a1575211b3302cc03fc911c9d85
SHA19ba03b705bdc73410ce3a3a6fa012cc1e4b2cf4a
SHA256af552bf75debb419f6f73ef0523739991feedad022d2c032e2d77d9c7114b9b9
SHA5126b3fac5fe3921bdb353170ad706d1692a86576dff0712548d1eddb8b3edc3c042c869332ab050d40db143154b5190ceca2ed65686dd6c61f5f58a36795be864b
-
Filesize
1.4MB
MD5a37881d992cc312b47152156e5d07b13
SHA1b8bb22cebef87dd4f3a629e23a5c0f3d180a55f8
SHA25677a29705efa35c4ade18da66c92ac82e5cf05f4ed782fbf09171c4c1b3cbcaf2
SHA512d50cb6a4a393299d73768b35a155f2cb74b5b08980f3476d80cd883a892d516075b23d4306fd19d4539fd06fbfd1e24e6f90b36028139ef4090397d2030edafd
-
Filesize
1.4MB
MD57e07f2102522c689a218aa2302eb2477
SHA1685aa448e632e5672105c78802ee6f7a6a01db97
SHA256e76e9a764129dc0dd60fbc76e84f7f95acedafe9e1392ada567b422b8ca2f8ed
SHA5121295e0be56a8450750421561365b67c65dbf6a6cc401ff2419a86f3d98f02237c3017d28f20d4b30eac2f222f8df10c592b5f2f450a227e38c032718d5a97ca9
-
Filesize
1.8MB
MD53f8e0172978740a914f0085fe53aa077
SHA19fd8a622a1e3eab236d834d3c5b5e628338790b3
SHA25674a2529765b3cb7db711da3e1956bfb196a9cc856b17a3e18d088c5e2f824347
SHA512ff041d26014f14f166a0fc8c7f4f076f74cde9df71ff5dd7af04b037a4dfc10fe74538b50e0c1b8bf21eb618bff1857c939ce11be88c9e92af4e18e1c01edb55
-
Filesize
1.4MB
MD54d6a7a683227c9497c0a3b909a7d9045
SHA1e1482129f1b905aac637aca091d9b74f1d41eca1
SHA256ba54a8ce312e3f49add81f1e2fa18e33bbb869b7c377e6874f523e49bbd9cbaa
SHA5122144ee94ba03002c15dddfc206f84f821488718a5069403e8b87026fbf18e3204b257b6ac312bdc295bc88abf7f6422c1a08ff9b6939c076a49db53d7649d536
-
Filesize
1.6MB
MD5182d0acfade87c2a1dcc2eb885aacde3
SHA12720907773d1e0353cf809d34ef22b8053e73848
SHA256651fcbee2cb5c4779508d501b68a6c7a6ac0cc5fbffda2b74a5e35159b58adc5
SHA5125b03f34607057bba09d96c5752b12a916f1bcde74e351f0d0ce669b9590ca856289ee61aae0a7a451cb41bc27bcdff6cd48f26d5f4b90ae22351529ead8258d9
-
Filesize
2.0MB
MD5476ed9dac84e3bbfd1f5d0457ee4c936
SHA17243648e13a5352d5bd96f4d5f6d73d94ee69e86
SHA2566eac76eac2206bca55164d9fa3e92359708823829bef90fe21de6329419525c4
SHA51258dcc4c88a0e4be63ffc4fb57217b4cc7778c3c98b793266e028a832362f476070f359a4f7eba5f09503b2a9d9f0b7eb5c425076b9cae10ea9e0f337858a6cf9
-
Filesize
1.4MB
MD5fcd81fa13f08e44d53a4d5109ec34b55
SHA15ed422bc961532ee5eaf0b58d048a832aa45126f
SHA256b35040df596eb5b0db6f7b2354ef9cc62ed0efb7a62e063871365732dc43920e
SHA512fcc6a3766e49ec4e7c9cf2220cec4d2c1ee53e317994fa9a7d578eb84bd15a7946fdacd56a333a0dc2f32ffbb453d1efbf2c4c9fa5d32045250a5be5e8a71849
-
Filesize
1.4MB
MD511a40940f6a82eb536438899313f5d07
SHA1f6c8cbd9794be5cfa86661c486ddade14f7d7583
SHA2569a53772c66b0b85fbedf3a319926b3147882db100b6c28094283b067929ad001
SHA512e480257893cbcc4124f460e1bf897e5ce24fbddf5cb265367d9d6492ef3a4045f4244c97a1c2f758560c7eba415910c4aa0496356d306e159ee529e312cbc6c8
-
Filesize
1.3MB
MD5b640a20c275070d6e562ddfac516fa6c
SHA10faed0ff6ece443ae279d93f51a2f07855a96354
SHA2568d966dadad6594ffaacd1eecea26c4436468a5d254558cd74a658ebd3940d276
SHA51248a6e634c50a500e40f4c59783814ff2ed40c90b40bbd82ddadfa432c250b8dc0a425b0c9e6cf71682d238e7efb70dc023d69e17679770d63b55e712ff880038
-
Filesize
1.3MB
MD547dc0389dd37f877d90d59de5d4c11d6
SHA19b0c043d2c5baaddeb461f1c4b1508c92fc6f24f
SHA2568837fe0d6eb42724d12b8e07efa8fa5d43ff96013a4070a19a69c47e13790f1c
SHA51220bba20cd72c8f75d8bd1b45a3bc1ca0b208b6d0b17413d9a382cc70e141839e29cf274ff8cbb6be0b60c27c0acedcc9339c99da9a8e3d1db3de16586a8405c9
-
Filesize
1.5MB
MD59cff075c8ebeb2c4b8693a2f15719ed6
SHA116f5bdb3a77ea4fa034ca4cb17669c211645bf4d
SHA256ff46074dbbb2e8219ddfdeed08ce08ccd5aec385cdb91cc680f19073fe2987be
SHA5126eda7a6db58bdd04d5e76f6781fcf67977b3b7ffea1ca27a77082135175487805b74a03c8d01450e715e7fab8f591625fcbb618205d87cc5e333405e1ba88e94
-
Filesize
2.1MB
MD5a1cd3bcc7e08c0aa3e4caa03a982c1d4
SHA11f917480714daa7a79e31f7309c77fd625e2640d
SHA2561b5a5ad3884598307b9f202a17cfc6d039c660e206fbeb5b6205387de7ca3847
SHA512a805c20369986139c89a8aecee8549258b4d0f1c7f433c5df85f6274a8b0587194d1ac2337d2e58c030230b36d0e044def3f5cb718448f4356b28bc47158faba
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
27.0MB
-
Filesize
27.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB