Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe
-
Size
7.1MB
-
MD5
cd4e0696f981277d3f3513f34549f125
-
SHA1
43fa109b18d953344faae6afb987809a9a0a266a
-
SHA256
59cf20a6b5ad5973b75fe12431bb5e3455650cc3176cef5aeaca0e7da7cb09ee
-
SHA512
87f160cea14d958950010142d49f49b7522bbe1625665a56830b5c77b405627cc79405af235d0a238eaad7627774a009231527e7678b712b7b365090316cac86
-
SSDEEP
98304:n9xyitjorTcHhK3Dcwbp2VMprvrGD7nTsR:mp/cHhw2MR
Malware Config
Signatures
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 3 IoCs
pid Process 1004 sysx32.exe 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 2740 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sys32 = "C:\\Windows\\system32\\sysx32.exe" 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: sysx32.exe File opened (read-only) \??\N: sysx32.exe File opened (read-only) \??\S: sysx32.exe File opened (read-only) \??\T: sysx32.exe File opened (read-only) \??\V: sysx32.exe File opened (read-only) \??\H: sysx32.exe File opened (read-only) \??\B: sysx32.exe File opened (read-only) \??\E: sysx32.exe File opened (read-only) \??\L: sysx32.exe File opened (read-only) \??\O: sysx32.exe File opened (read-only) \??\Q: sysx32.exe File opened (read-only) \??\R: sysx32.exe File opened (read-only) \??\Y: sysx32.exe File opened (read-only) \??\A: sysx32.exe File opened (read-only) \??\P: sysx32.exe File opened (read-only) \??\U: sysx32.exe File opened (read-only) \??\X: sysx32.exe File opened (read-only) \??\Z: sysx32.exe File opened (read-only) \??\J: sysx32.exe File opened (read-only) \??\I: sysx32.exe File opened (read-only) \??\K: sysx32.exe File opened (read-only) \??\W: sysx32.exe File opened (read-only) \??\G: sysx32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe sysx32.exe File created C:\Windows\SysWOW64\netsh.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\verclsid.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\control.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe sysx32.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\powercfg.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\regedt32.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\net.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dplaysvr.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\setx.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\certreq.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\mavinject.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\stordiag.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\whoami.exe sysx32.exe File created C:\Windows\SysWOW64\dpapimig.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\logman.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe sysx32.exe File created C:\Windows\SysWOW64\edpnotify.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\runonce.exe sysx32.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\SettingSyncHost.exe sysx32.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\finger.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\regini.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe sysx32.exe File created C:\Windows\SysWOW64\autoconv.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\dialer.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe sysx32.exe File created C:\Windows\SysWOW64\wermgr.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe sysx32.exe File created C:\Windows\SysWOW64\Netplwiz.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE sysx32.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\recover.exe.tmp sysx32.exe File created C:\Windows\SysWOW64\xwizard.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\calc.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe.tmp sysx32.exe File opened for modification C:\Windows\SysWOW64\printui.exe sysx32.exe File opened for modification C:\Windows\SysWOW64\systray.exe.tmp sysx32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe sysx32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.tmp sysx32.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe.tmp sysx32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.tmp sysx32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp sysx32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe sysx32.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe sysx32.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe sysx32.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp sysx32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp sysx32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.tmp sysx32.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe sysx32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp sysx32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe sysx32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe.tmp sysx32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp sysx32.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp sysx32.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchFilterHost.exe sysx32.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_6331d348ae4a8fa9\poqexec.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\eshell.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\r\BackgroundTransferHost.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\f\recdisc.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\r\Win32WebViewHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.1_none_ab86440d95c72095\logagent.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\r\bcdboot.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\r\Dxpserver.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1_none_97e4facd611ea96a\autochk.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\f\WorkFolders.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\XblGameSaveTask.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\r\hvsiproxyapp.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_260e545bf60f6b0f\cliconfg.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\r\SearchApp.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\MoUsoCoreWorker.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\r\ntprint.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\r\hvsiproxyapp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\f\InputSwitchToastHandler.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\rmttpmvscmgrsvr.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\r\SystemSettingsAdminFlows.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXLauncher.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\f\WmsSessionAgent.exe sysx32.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe sysx32.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15805.0_none_b2fd45ddd475eb50\ngen.exe.tmp sysx32.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmstp.exe.tmp sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe.tmp sysx32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\WSReset.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\UtcDecoderHost.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe sysx32.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671_winload.exe_75835076 sysx32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\r\MDMAgent.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.1_none_e768b85cf7ad062e\TSWbPrxy.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\f\TSTheme.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrshost.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a22e961d4bcae1e\UndockedDevKit.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgrsvr.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\SpaceAgent.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ROUTE.EXE.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\sethc.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c8f9d36146564b7f\aspnet_regiis.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\r\CompatTelRunner.exe.tmp sysx32.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.19041.1_none_7b261299a50c8282\DFDWiz.exe.tmp sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\f\wscript.exe sysx32.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\f\BitLockerDeviceEncryption.exe sysx32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysx32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1004 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 84 PID 2796 wrote to memory of 1004 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 84 PID 2796 wrote to memory of 1004 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 84 PID 2796 wrote to memory of 2108 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 85 PID 2796 wrote to memory of 2108 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 85 PID 2796 wrote to memory of 2108 2796 2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 85 PID 2108 wrote to memory of 2740 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 88 PID 2108 wrote to memory of 2740 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 88 PID 2108 wrote to memory of 2740 2108 _2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\sysx32.exeC:\Windows\system32\sysx32.exe /scan2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exeC:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exeC:\Users\Admin\AppData\Local\Temp\_2024-11-05_cd4e0696f981277d3f3513f34549f125_magniber.exe --type=collab-renderer --proc=21083⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD5cf91782089cf539220245a8ab01a89ce
SHA1282f6f74537fa89a6e69a5210b14dd450b725f57
SHA25636198acb04425ee207c21504171bbc9ae3f860e75d1f6d4aea9c1b476c596449
SHA512a5ace830c7553e5428c64f6f7679afebf63f1db256d9151058effc0d36b07ca265a3372d18503cbf0d847e5def4878d82cd032146deb096e476a439fd7f917bb
-
Filesize
7.1MB
MD505fc7907ae77304429f2099533e39e73
SHA1f3e98ee40c9473d64222e4ecb783aa5234767719
SHA256ee5a827a0d216ea35652c121ec85be227832e81592f4eeb6ea78012f0a6ce207
SHA5126e7a56b53b73aaa1dfcc1ef721bf421f557872d2222db3cb43ee78ac4ca22eae2f1b2dd53eeec332e15262efd1cef778662b164a41d58570f43348730cc8d93d
-
Filesize
7.1MB
MD5cd4e0696f981277d3f3513f34549f125
SHA143fa109b18d953344faae6afb987809a9a0a266a
SHA25659cf20a6b5ad5973b75fe12431bb5e3455650cc3176cef5aeaca0e7da7cb09ee
SHA51287f160cea14d958950010142d49f49b7522bbe1625665a56830b5c77b405627cc79405af235d0a238eaad7627774a009231527e7678b712b7b365090316cac86