Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 07:44
Static task
static1
Behavioral task
behavioral1
Sample
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe
Resource
win7-20240611-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe
-
Size
4.5MB
-
MD5
45f8192ee22dcade6d9a5611b4c72ae3
-
SHA1
ac840f8b54d9b171654dafd9a6dd59228bb0c1da
-
SHA256
b41967a2959babaff6ce13025f0a110665457dfb6450109af190abf33444bf68
-
SHA512
3fdf564af0000cb4fe40348e067f86321139fc4d7182d8d878f62a8152e10d585e42e3a52847a9b11d238a36bb745aac03ba5d5503964068141c8f7d0e250bd8
-
SSDEEP
98304:UB7HjhbIy9BU8djoD+lCnUOOOPRKzsTNyCXauK871oMHfA:UB7Hdxo66OIEsTmoZowo
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe -
Modifies registry class 64 IoCs
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E}\FriendlyName = "WM ASF Reader" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{42150CD9-CA9A-4EA5-9939-30EE037F6E74}\FilterData = 020000000000200002000000000000003070693300000000000000000600000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003170693308000000000000000400000000000000000000003074793300000000500100006001000031747933000000005001000070010000327479330000000050010000800100003374793300000000e0000000600100007669647300001000800000aa00389b715955593200001000800000aa00389b714959555600001000800000aa00389b714934323000001000800000aa00389b715956313200001000800000aa00389b715559565900001000800000aa00389b717deb36e44f52ce119f530020af0ba77083eb36e44f52ce119f530020af0ba77026806de046dbcf11b4d100805f6cbbea22806de046dbcf11b4d100805f6cbbea23806de046dbcf11b4d100805f6cbbea 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{8A51DC27-5A35-4E02-95A3-428BC6244A3C} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}\CLSID = "{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\FilterData = 0200000000006000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000007669647300001000800000aa00389b7100000000000000000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}\CLSID = "{6CFAD761-735D-4AA5-8AFC-AF91A7D61EBA}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\InprocServer32\ThreadingModel = "Both" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1A56451B-1315-4012-861E-8587333DD631}\FilterData = 02000000000020000100000000000000307069330800000000000000010000000000000000000000307479330000000038000000480000007669647300001000800000aa00389b7100000000000000000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{2DB47AE5-CF39-43C2-B4D6-0CD8D90946F4} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\CLSID = "{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}\CLSID = "{C9F5FE02-F851-4EB5-99EE-AD602AF1E619}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}\CLSID = "{1643E180-90F5-11CE-97D5-00AA0055595A}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\FriendlyName = "MPEG Audio Decoder" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{FA10746C-9B63-4B6C-BC49-FC300EA5F256} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375}\FilterData = 0200000000006000020000000000000030706933090000000000000001000000000000000000000030747933000000006000000070000000317069330000000000000000010000000000000000000000307479330000000080000000700000006175647300001000800000aa00389b712c806de046dbcf11b4d100805f6cbbea83eb36e44f52ce119f530020af0ba770 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{3E458037-0CA6-41aa-A594-2AA6C02D709B}\FilterData = 02000000000020000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42}\FilterData = 020000000000800002000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b716476736400001000800000aa00389b716476632000001000800000aa00389b7100000000000000000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42}\CLSID = "{129D7E40-C10D-11D0-AFB9-00AA00B67A42}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}\CLSID = "{301056D0-6DFF-11D2-9EEB-006008039E37}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{7C23220E-55BB-11D3-8B16-00C04FB6BD3D}\FilterData = 02000000000040000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{9B8C4620-2C1A-11D0-8493-00A02438AD48}\FriendlyName = "DVD Navigator" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{B1B77C00-C3E4-11CF-AF79-00AA00B67A42} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\FriendlyName = "File stream renderer" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{7B3BC2A0-AA50-4ae7-BD44-B03649EC87C2}\FilterData = 02000000000020000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C1F400A4-3F08-11D3-9F0B-006008039E37}\FriendlyName = "Null Renderer" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C666E115-BB62-4027-A113-82D643FE2D99}\FilterData = 02000000ffff5f000100000000000000307069330000000000000000010000000000000000000000307479330000000038000000480000006c175f45064bce479aef8caef73df7b55be592c82d25b542a316d997e7a5d995 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{FA10746C-9B63-4B6C-BC49-FC300EA5F256}\CLSID = "{FA10746C-9B63-4B6C-BC49-FC300EA5F256}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{FC772AB0-0C7F-11D3-8FF2-00A0C9224CF4} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375}\CLSID = "{A0025E90-E45B-11D1-ABE9-00A0C905F375}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{ACD453BC-C58A-44D1-BBF5-BFB325BE2D78}\CLSID = "{ACD453BC-C58A-44D1-BBF5-BFB325BE2D78}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1f26a602-2b5c-4b63-b8e8-9ea5c1a7dc2e} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1f26a602-2b5c-4b63-b8e8-9ea5c1a7dc2e}\FilterData = 02000000000020000000000000000000 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{3AE86B20-7BE8-11D1-ABE6-00A0C905F375}\FriendlyName = "MPEG-2 Splitter" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{48025243-2D39-11CE-875D-00608CB78066} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}\CLSID = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}\FilterData = 020000000100400002000000000000003070693300000000000000000600000000000000000000003074793300000000000100001001000031747933000000000001000020010000327479330000000000010000300100003374793300000000000100004001000034747933000000000001000050010000357479330000000000010000600100003170693308000000000000000600000000000000000000003074793300000000000100001001000031747933000000000001000020010000327479330000000000010000300100003374793300000000000100004001000034747933000000000001000050010000357479330000000000010000600100007669647300001000800000aa00389b717aeb36e44f52ce119f530020af0ba7707ceb36e44f52ce119f530020af0ba7707beb36e44f52ce119f530020af0ba7707deb36e44f52ce119f530020af0ba7707eeb36e44f52ce119f530020af0ba770c09a3c777432d011b72400aa006c1a01 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\CLSID = "{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{42150CD9-CA9A-4EA5-9939-30EE037F6E74} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}\CLSID = "{8596E5F0-0DA5-11D0-BD21-00A0C911CE86}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}\CLSID = "{D51BD5A3-7548-11CF-A520-0080C77EF58A}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{187463A0-5BB7-11D3-ACBE-0080C75E246E}\CLSID = "{187463A0-5BB7-11D3-ACBE-0080C75E246E}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C666E115-BB62-4027-A113-82D643FE2D99}\CLSID = "{C666E115-BB62-4027-A113-82D643FE2D99}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C9F5FE02-F851-4EB5-99EE-AD602AF1E619} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\CLSID = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\CLSID = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{129D7E40-C10D-11D0-AFB9-00AA00B67A42} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{370A1D5D-DDEB-418C-81CD-189E0D4FA443} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{5F5AFF4A-2F7F-4279-88C2-CD88EB39D144}\FriendlyName = "Microsoft MPEG-2 Encoder" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\FriendlyName = "Video Renderer" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{A0025E90-E45B-11D1-ABE9-00A0C905F375} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{E1F1A0B8-BEEE-490D-BA7C-066C40B5E2B9}\Capabilities 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{280A3020-86CF-11D1-ABE6-00A0C905F375} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\CLSID = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{814B9800-1C88-11D1-BAD9-00609744111A} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{C1F400A0-3F08-11D3-9F0B-006008039E37}\CLSID = "{C1F400A0-3F08-11D3-9F0B-006008039E37}" 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574} 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8B897E62-A993-89B4-2ABF-23B848BF7E76}\Instance\{6E8D4A20-310C-11D0-B79A-00AA003767A7}\FilterData = 02000000000060000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000700000003170693308000000000000000100000000000000000000003074793300000000800000007000000080ea0a67823ad011b79b00aa003767a7000000000000000000000000000000007669647300001000800000aa00389b71 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exedescription pid process Token: 33 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Token: SeIncBasePriorityPrivilege 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Token: 33 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe Token: SeIncBasePriorityPrivilege 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exepid process 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2168 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exedescription pid process target process PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe PID 2808 wrote to memory of 2168 2808 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe 2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024070245f8192ee22dcade6d9a5611b4c72ae3magniber.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2168-18-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-8-0x0000000002D70000-0x0000000002F4F000-memory.dmpFilesize
1.9MB
-
memory/2168-19-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-2-0x0000000002D70000-0x0000000002F4F000-memory.dmpFilesize
1.9MB
-
memory/2168-28-0x0000000002D70000-0x0000000002F4F000-memory.dmpFilesize
1.9MB
-
memory/2168-10-0x0000000000A25000-0x0000000000A26000-memory.dmpFilesize
4KB
-
memory/2168-11-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-15-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-21-0x00000000003E0000-0x0000000000400000-memory.dmpFilesize
128KB
-
memory/2168-16-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-27-0x0000000002D70000-0x0000000002F4F000-memory.dmpFilesize
1.9MB
-
memory/2168-1-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-14-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-22-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-23-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-20-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2168-24-0x0000000002D70000-0x0000000002F4F000-memory.dmpFilesize
1.9MB
-
memory/2168-26-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2808-25-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB
-
memory/2808-30-0x0000000002CB0000-0x00000000037E4000-memory.dmpFilesize
11.2MB
-
memory/2808-9-0x0000000002CB0000-0x00000000037E4000-memory.dmpFilesize
11.2MB
-
memory/2808-0-0x0000000000400000-0x0000000000F34000-memory.dmpFilesize
11.2MB