Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe
-
Size
9.5MB
-
MD5
ba3a2af30efd8c3138475810580be6ee
-
SHA1
7304c4f8b3865d0b3b49a6deed53a571f6066061
-
SHA256
a3f168db9898d46e29efb229aea33e6082cfa6085eed3adec10de02fa4a25988
-
SHA512
78c26ec428ed606b88c6e8c74217f4e07c329b50406ae64946f34b5216be82de80329cc8799d7b80cf0872a339ff1f9313accaf49c83e9eabec805aa2137ed5d
-
SSDEEP
196608:mp/cHhw2rNAWgd/i7D4/mO4y/i2GhC5HeHxMX0RyXI:YcDuWgd/i7C/iHh4WxPf
Malware Config
Signatures
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 3 IoCs
pid Process 4768 sysx32.exe 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 2268 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\G: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\Y: sysx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\label.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\proquota.exe sysx32.exe File created C:\Windows\SysWOW64\wiaacmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\tar.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sethc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\compact.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\doskey.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\Fondue.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE sysx32.exe File opened for modification C:\Windows\SysWOW64\raserver.exe sysx32.exe File created C:\Windows\SysWOW64\RdpSa.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\regedit.exe sysx32.exe File created C:\Windows\SysWOW64\mspaint.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\rrinstaller.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\sethc.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\TSTheme.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe sysx32.exe File created C:\Windows\SysWOW64\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\CredentialUIBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe sysx32.exe File created C:\Windows\SysWOW64\colorcpl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SettingSyncHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\waitfor.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\gpresult.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net1.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\tracerpt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\user.exe sysx32.exe File created C:\Windows\SysWOW64\comp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\charmap.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\expand.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\perfmon.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\ttdinject.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\netbtugc.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe sysx32.exe File created C:\Windows\SysWOW64\Magnify.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\netsh.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe sysx32.exe File created C:\Windows\SysWOW64\certreq.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\help.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\resmon.exe.tmp sysx32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe sysx32.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE sysx32.exe File created C:\Program Files\Windows Mail\wab.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.tmp sysx32.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp sysx32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe sysx32.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe sysx32.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe.tmp sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp sysx32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe sysx32.exe File opened for modification C:\Program Files\7-Zip\7zG.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp sysx32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\fontdrvhost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\aspnet_compiler.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe.tmp sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\f\WpcMon.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\r\WSReset.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\ThumbnailExtractionHost.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.19041.1_none_462739ece97bd4ed\vmconnect.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\AppVClient.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\f\wbengine.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_dd2098e5f9122dff\findstr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_684a86f0f0d0d27d\mountvol.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\ResetEngine.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\SyncAppvPublishingServer.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\Taskmgr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\r\wermgr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\r\SearchProtocolHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_81941817097d6ad9\TokenBrokerCookies.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\f\Utilman.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchProtocolHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\OOBENetworkConnectionFlow.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\unlodctr.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\aspnetca.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\r\msconfig.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_a5a5fe7757df26e3\NcsiUwpApp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\WSManHTTPConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\gpscript.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\r\wusa.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\rrinstaller.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\comp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acsr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\f\mofcomp.exe.tmp sysx32.exe File opened for modification C:\Windows\bfsvc.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_9fe20fdb296d6341\r\edpnotify.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\r\PickerHost.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_23f80ea3f041fc17\SystemPropertiesProtection.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\f\ByteCodeGenerator.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\MsSense.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchFilterHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_81941817097d6ad9\TokenBrokerCookies.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_2305f6cf48d996c7\EaseOfAccessDialog.exe sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_e888ea072e0fed05\tasklist.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1_none_55c691f63ac916c4\wuapihost.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\f\LockAppHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\r\lpkinstall.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\r\imecfmui.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\r\notepad.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\f\spoolsv.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.19041.1_none_0ea013578aa5744f\setupcl.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.1_none_524d53b764fb40e1\CloudNotifications.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\ScriptRunner.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\CloudNotifications.exe.tmp sysx32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 224 wrote to memory of 4768 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 84 PID 224 wrote to memory of 4768 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 84 PID 224 wrote to memory of 4768 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 84 PID 224 wrote to memory of 4860 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 85 PID 224 wrote to memory of 4860 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 85 PID 224 wrote to memory of 4860 224 2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 85 PID 4860 wrote to memory of 2268 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 87 PID 4860 wrote to memory of 2268 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 87 PID 4860 wrote to memory of 2268 4860 _2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\_2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exeC:\Users\Admin\AppData\Local\Temp\_2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\_2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exeC:\Users\Admin\AppData\Local\Temp\_2024-11-05_ba3a2af30efd8c3138475810580be6ee_magniber.exe --type=collab-renderer --proc=48603⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.5MB
MD52b96aeffee3dd2d8d74b0b8f6b418411
SHA1beae9f704b036133a296b39a8e43a4092bfb9c58
SHA2566563be834a0ba75d2d0748170613751fbade8c8eeb89f197cdbd730d45b3858f
SHA5129a767a44c477e1ca15a043ce167331f43f4703db0a9bfd3211d5e3e2d6bb0bcf3e9d38d22971b3418f8545fa0df1398df4e866ec999a8346355590a55320301a
-
Filesize
9.5MB
MD588fb8ea77eefc3141c19792ad3b74b45
SHA12ab88d0661d9c778ad2692d4a4c13543eade672d
SHA256be5512a54d2614bc406b70b9477f90935732da6b81b673e0b091c17110cbf3c7
SHA5125c44960917578a26f604ef0d16b7f77148e7e0a2a02a54a36543f0bf13c2958d6c2b4043af5cae6d5e3e6a3c22398e7b2cc60bbe3f28468f54372e497386038e
-
Filesize
9.5MB
MD5ba3a2af30efd8c3138475810580be6ee
SHA17304c4f8b3865d0b3b49a6deed53a571f6066061
SHA256a3f168db9898d46e29efb229aea33e6082cfa6085eed3adec10de02fa4a25988
SHA51278c26ec428ed606b88c6e8c74217f4e07c329b50406ae64946f34b5216be82de80329cc8799d7b80cf0872a339ff1f9313accaf49c83e9eabec805aa2137ed5d