Overview
overview
10Static
static
10magik remake.rar
windows11-21h2-x64
3magik rema....vsidx
windows11-21h2-x64
3magik rema....vsidx
windows11-21h2-x64
3magik rema...7/.suo
windows11-21h2-x64
3magik rema...p.json
windows11-21h2-x64
3magik rema...t.json
windows11-21h2-x64
3magik rema...p2.sln
windows11-21h2-x64
3magik rema...e.json
windows11-21h2-x64
3magik rema...config
windows11-21h2-x64
3magik rema...ner.cs
windows11-21h2-x64
3magik rema...rm1.cs
windows11-21h2-x64
3magik rema...m1.vbs
windows11-21h2-x64
1magik rema...ner.cs
windows11-21h2-x64
3magik rema...rm2.cs
windows11-21h2-x64
3magik rema...m2.vbs
windows11-21h2-x64
1magik rema...ner.cs
windows11-21h2-x64
3magik rema...m4.vbs
windows11-21h2-x64
1magik rema...er.vbs
windows11-21h2-x64
1magik rema...es.vbs
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...UI.dll
windows11-21h2-x64
1magik rema...p2.exe
windows11-21h2-x64
10magik rema...cs.dll
windows11-21h2-x64
1magik rema...p2.exe
windows11-21h2-x64
3magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1magik rema...I2.dll
windows11-21h2-x64
1Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-09-2024 07:29
Behavioral task
behavioral1
Sample
magik remake.rar
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
magik remake/.vs/WindowsFormsApp2/FileContentIndex/bbcfc6bb-cd18-4b63-9c13-bf9271aa79e7.vsidx
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
magik remake/.vs/WindowsFormsApp2/FileContentIndex/dd5ae10a-f103-4e06-adf0-26a038b47d16.vsidx
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
magik remake/.vs/WindowsFormsApp2/v17/.suo
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
magik remake/.vs/WindowsFormsApp2/v17/DocumentLayout.backup.json
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
magik remake/.vs/WindowsFormsApp2/v17/DocumentLayout.json
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
magik remake/WindowsFormsApp2.sln
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
magik remake/WindowsFormsApp2/.vs/WindowsFormsApp2.csproj.dtbcache.json
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
magik remake/WindowsFormsApp2/App.config
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
magik remake/WindowsFormsApp2/Form1.Designer.cs
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
magik remake/WindowsFormsApp2/Form1.cs
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
magik remake/WindowsFormsApp2/Form1.vbs
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
magik remake/WindowsFormsApp2/Form2.Designer.cs
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
magik remake/WindowsFormsApp2/Form2.cs
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
magik remake/WindowsFormsApp2/Form2.vbs
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
magik remake/WindowsFormsApp2/Form4.Designer.cs
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
magik remake/WindowsFormsApp2/Form4.vbs
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
magik remake/WindowsFormsApp2/Properties/Resources.Designer.vbs
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
magik remake/WindowsFormsApp2/Properties/Resources.vbs
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
magik remake/WindowsFormsApp2/bin/Debug/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
magik remake/WindowsFormsApp2/bin/Debug/Siticone.UI.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
magik remake/WindowsFormsApp2/bin/Debug/WindowsFormsApp2.exe
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
magik remake/WindowsFormsApp2/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
magik remake/WindowsFormsApp2/obj/Debug/WindowsFormsApp2.exe
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net40/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net45/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net461/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net472/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net48/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net6.0-windows7.0/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/net7.0-windows7.0/Guna.UI2.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
magik remake/packages/Guna.UI2.WinForms.2.0.4.6/lib/netcoreapp3.1/Guna.UI2.dll
Resource
win11-20240802-en
General
-
Target
magik remake/WindowsFormsApp2/Form2.cs
-
Size
3KB
-
MD5
00347712af0aff05d459c72a00d4c7fb
-
SHA1
ad45023d141e76b99e4ebf93b62f44f55097eb69
-
SHA256
33b09d50655d4ebd62f4b92f71fd9e06717f4c2e61ab379c9d8b6d4ddc8b4d90
-
SHA512
c24cc3dc26c14ad3e138efb048b1c610c0740767fa375065ad6a5c080ed577c58f71ed30f81faa882e9ff01661361b90cebb62e9f2b369cf4d0ecc362b770846
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3336 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\magik remake\WindowsFormsApp2\Form2.cs"1⤵
- Modifies registry class
PID:4040
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3336