Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe
- Size 641KB
- Sample260629-ejy28ady4r
- SHA256 4a06b767aa4dde326cd537e8ee35311858b53195d41b342809211ec71ac39a20
- MD5 ad30f2d40ece9298f39a35fb4cb429a2
- SHA1 4239e46736fd3e3821ff8bea9c2aad7422dadd87
- SHA512 c0285fa328fdf0c7251774ad66bb6a58ac730c07bafd6f638193ee16c8eb0f8fe61c87464ecdce97a8f7d6006413db7bc9f5f4fd3166c4585d84e0414acb3476
- SSDEEP 12288:WRvec5T/QTU+R4IfGQCPpTO278fc3Td4zZohAhTIi9gEcaQM9cWR+NDeB6:Wpec5ToTEzQkpTP8U3TKeh4PgmP93R+i
- TLSH T1F6D4E02139C4C075D2672573C87DDBF85AEDBC24AA61655B3BDE3A783F306D1922038A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn\CurVer 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\VersionIndependentProgID 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib\ = "{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\LocalServer32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\TypeLib\ = "{eccf7669-da0c-4db6-95eb-b13ff3767374}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib\Version = "1.0" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe:typelib" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\ = "Inst Class" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\HELPDIR 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\Version 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ = "IBoot" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\Programmable 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\HELPDIR 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn.1\ = "Inst Class" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn\ = "Inst Class" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\Programmable 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\ = "InstallerLib" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib\Version = "1.0" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\LocalServer32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn.1\CLSID\ = "{41c89350-3334-4b7f-bac1-30c739447858}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0\win32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib\ = "{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\VersionIndependentProgID 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\ProgID 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\FLAGS 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn.1 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\FLAGS 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn\CurVer 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\ProgID 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn.1 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\VersionIndependentProgID\ = "crinoids.inn" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\Version\ = "1.0" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5} 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C92BEDE3-9C3D-46E0-8DB6-D878330CBDC5}\TypeLib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn.1\CLSID 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\ProgID\ = "crinoids.inn.1" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41c89350-3334-4b7f-bac1-30c739447858}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECCF7669-DA0C-4DB6-95EB-B13FF3767374}\1.0\0\win32 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\crinoids.inn\CurVer\ = "crinoids.inn.1" 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe:typelib 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4368 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe 4368 2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad30f2d40ece9298f39a35fb4cb429a2_elex_mafia_magniber.exe:typelib
- Size 7KB
- SHA256 f2c64da19c29e3b5b69247561d16c2a3d3f211d4af1174955ddb059319539b81
- MD5 e9305e6a1a09773d0990e3c181067e65
- SHA1 62014ada88afb30c7bda6f59fc190bddea5d51c6
- SHA512 689ddf862ef0da0708d61fc255873d4c8b3aaa0e1e965993ce18dbdfbce7a0ca1ceb75331b46deb946e3a19144d46e502ef9cd609c9c83a7e69aa060f720263d
- SSDEEP 192:Upwa3mVTj+EXfm7cciisbYKmACVhciYTBNG:51VTlXu7cjisPzmhciYHG
- TLSH T18DF1D976FB81CEB2C51C01351D5F57E21AE0ECA40D55BA2B338873ADCE723857B529A1
- MD5 SHA1 SHA512 SSDEEP TLSH