General
-
Target
ddf798fa09f7c72f9fec4478841990d7.msi
-
Size
92KB
-
Sample
220914-28j1xsbee6
-
MD5
ddf798fa09f7c72f9fec4478841990d7
-
SHA1
42b8bc580bd77c330432fb7cf6d9b8c8212961bd
-
SHA256
b2b07b32c681a44c647814d09eeac5d691ae67ebf1862bd23c639fce7027685a
-
SHA512
fa39bd42f000e8dffb4638a65cb08ab0f4393a7ed8ef718efa7f3652c00cd1aa31c6f3fb5365674700a08eb066d3e514e7f8131fce0bccd9b5897ea96c9b2425
-
SSDEEP
768:8lUJ5BxTORGx4/dpZ6G+jzI/RyGwaW27N5MSdm4cyWMDC/yWMDCmYinj:hxTcdpZ6G//RzwaN1d00DU0D37n
Static task
static1
Behavioral task
behavioral1
Sample
ddf798fa09f7c72f9fec4478841990d7.msi
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ddf798fa09f7c72f9fec4478841990d7.msi
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3064_104092216\us_tv_and_film.txt
Targets
-
-
Target
ddf798fa09f7c72f9fec4478841990d7.msi
-
Size
92KB
-
MD5
ddf798fa09f7c72f9fec4478841990d7
-
SHA1
42b8bc580bd77c330432fb7cf6d9b8c8212961bd
-
SHA256
b2b07b32c681a44c647814d09eeac5d691ae67ebf1862bd23c639fce7027685a
-
SHA512
fa39bd42f000e8dffb4638a65cb08ab0f4393a7ed8ef718efa7f3652c00cd1aa31c6f3fb5365674700a08eb066d3e514e7f8131fce0bccd9b5897ea96c9b2425
-
SSDEEP
768:8lUJ5BxTORGx4/dpZ6G+jzI/RyGwaW27N5MSdm4cyWMDC/yWMDCmYinj:hxTcdpZ6G//RzwaN1d00DU0D37n
Score10/10-
Detect magniber ransomware
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Blocklisted process makes network request
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-