Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
15-09-2022 01:04
General
-
Target
SYSTEM.Security.Database.Upgrade.Win10.0.jse
-
Size
185KB
-
MD5
f6d2fc78661b55258fb704f66c9949e4
-
SHA1
7c4608440e4afcb032890edd4deef18a0ce3c8dd
-
SHA256
6a68217b951f9655e4a7ed13fcfc4696ac5d231450fe7d2be8b6a1d71425752c
-
SHA512
9f66641f19e8046b19f7bffa056ec3e677aae853102dded94c22665381d0d2b65334c16c74d7b64df319b1518931d6ad281ad86c1fbc67ee6ba1984f67506dce
-
SSDEEP
3072:dthtQYzUz8giIajyEPeR00t/+DYhRkEIKf+6yr3S1IuIDbHBX66vPYH/J25gfgbD:z73zUz8gCjyUeihSRkCy3H36HxgbD
Malware Config
Signatures
-
Detect magniber ransomware 3 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 40 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3220 -s 10442⤵
- Program crash
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Modifies registry class
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\SYSTEM.Security.Database.Upgrade.Win10.0.jse"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\cmd.exe/c fodhelper.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exefodhelper.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exe"wscript.exe" /B /E:VBScript.Encode ../../Users/Public/xyagozu.gif4⤵
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3024 -s 28722⤵
- Program crash
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
- Modifies extensions of user files
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
- Modifies registry class
-
C:\Windows\System32\cmd.exe/c fodhelper.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exefodhelper.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exe"wscript.exe" /B /E:VBScript.Encode ../../Users/Public/uvrjullp.gif4⤵
-
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 3220 -ip 32201⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet1⤵
- Process spawned unexpected child process
- Deletes backup catalog
-
C:\Windows\system32\wbadmin.exewbadmin delete systemstatebackup -quiet1⤵
- Process spawned unexpected child process
- Deletes System State backups
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete systemstatebackup -quiet1⤵
- Process spawned unexpected child process
- Deletes System State backups
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet1⤵
- Process spawned unexpected child process
- Deletes backup catalog
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 3024 -ip 30241⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358KB
MD594b0cbffc70a7c3a131c693cda046c55
SHA1b957207209e07071991020efc6d29044d62ad468
SHA2569f471af3941f52b2e3bbad293468524afd27d3feb76c337b520469b17dc1b362
SHA512dbbdd8c02f29eba21260c74fb057b4b945e65b736f811ce5946f63aff25967a66b43d867b70f6be93630583f74ce14ff9355d9c3ef2ab5871848a51c35a7cc5b
-
Filesize
682KB
MD589873817b0ccd5dafe73062452ed6b43
SHA16e560bd3360d5753e8785412ae077b604946ee43
SHA256ae7267a8a800e3f805d8fa2294dca86c18633ff14435d50b73c0a9b911143bcf
SHA51291fb05d25bec5bc9417d6f7a65bed539b556eb439b2b70cfa88466c5ad8a06dc7a6cb66ca0c2f6d43f823617af4b87ac47fc8bb69285793398d7229c17257718
-
Filesize
474KB
MD5ccee97adbb6b3a6b198d2bc37f853106
SHA13f9fb7507a6badbe225813b4bd75b99129b5ea1e
SHA2560f239c3394af4fb1926cb88dec6a1c8c92ee8b05994c11a63e7a0ec70beb642a
SHA512871b5698a63bd5aff84996b110450c045c6125cd7f846fc306dacf545fe52896fe8311e9813f3f03d957e8fe19fdcc75e7ba160f32d1eca4874ba1ce67f7b8b7
-
Filesize
798KB
MD5ebfb53b78b52622c1950491e01ef53c1
SHA187c55ec256eeee84daaf9ed3ea86655599f9e891
SHA25615184f4f02ac8f7fe95de0de9116d3d6e291ea33ad4ee3f7a4b8436c8e64a1ed
SHA5126ea3527db16d1e5a132730654bb260364586c30d97faf90647de1f7e9ab0c074cc16987f10746de1764979ef3a8e5a4353ebe20fa137e4a099596bfda6bc2d48
-
Filesize
1.3MB
MD5fc9c9edbadc006a0c9a1b0a6b9387599
SHA1058dc955494218b45dceeb362a11281def8111f5
SHA25656a1fa4f6097a1d32ff26cf722e600fd3ce0ac5936bab245f332de35ca849b71
SHA512d402efc77eb5df27b449a6ade24b3c662504571b2c64a5843f7a90c842c0e480ff776e741095cd1d34666cbcc48e6e1921fb0d5708961922fee187f26abf28c0
-
Filesize
752KB
MD59419dba78734c3d7e8d5de48ce36e987
SHA1acd9e09717dac5267971ebd37613a9f18f440f53
SHA25652ca71b0c4747f14017cf9b405831d2622765008a9218c6eca648997e8aba20a
SHA5125fcf7573a312694ebd0cc6eb18a742da252f3bdc53095fb5f6df9c4fd55bbf6d27ddd74f1460a1c073cac6e17bd4cfb5e60adf65b95d15b393ca3949348ca881
-
Filesize
937KB
MD593333c129a19f96d6944d3772d80f206
SHA1e1e4607b292aed64847b0bf2ff889e1a91217e76
SHA2567aa36c765e5ed1111a006768aac6cfc6f786b9106ad09715169d8fe234697171
SHA5124256d57d0dbdd59709d970557b517b8975bd95f9cc4daefcdd466df4661416bfd3ec6e610cad181a5de9737cbedf066e956fa391edd317a107731669555df92f
-
Filesize
705KB
MD581bfbf20dd9b4e83575e6d8ab404188f
SHA16c2a426705d831dd34bf2b939da4e8800549dd53
SHA256a014bb7a97ceb2a5306404cfd43ebf02bacc82d4a6aeb32b2e758c7616526d35
SHA512beab545bd81893bcbae0d26aa29aff9f0420468b362c3969df9623598ad96d9ce685c881cd066e5a79afc3b02941e8f0c758a23b624c83469008ba23f56a36d4
-
Filesize
15KB
MD53db953d2006fd5460d5b8d05bc9a3a93
SHA13e9513562d759b8976a16daf2860c5b04d00608b
SHA25681eb55b1c395cfba7105d53d9c4ca3434646f260b706190859e1d9669fba3d11
SHA512dc72379c8f44980d3c26a5e308d58eaf82556eb5b0fb4885e4b8f4e5e7b6250e91a117ad97e380f0fdebd28ff13f2054bae358c954623e24092728fc59dc1b36
-
Filesize
821KB
MD58e0a9ed2082a31f6a17520dbc339e18e
SHA15277a99f17a2a39b7d7cf7dc13e97e19f9c14e83
SHA256c88dd8fd47c185c1f5e79fce0045a5c1c2b74c8773b025a6e8b076b20c9f8149
SHA512bac2ba2b1f6e81a3c0622477d0acd172c490ef371c93a5e7d7271f4b48e8facf02679b36cdc02852cbf9686f689fed372d79c5c9bd36ece03c2713cde49abf78
-
Filesize
636KB
MD5265c41f7a81c50bfde970c9534516a03
SHA1ca734989113ec95917b05cfe2fe12522d547161c
SHA25689128055a9660f7fc2ee3274cf45f69005c7ab926ebbb9d793c6da3d5e3348f3
SHA51271e38e908ce1cd774e6d552cb2fef19f5894ea24b7ec575003c21355cdcc11af8f3a55fc4e7db0cdc2ef4a4933d62fab9221d76e5798159b3838148f16d589f2
-
Filesize
590KB
MD55baf5f25058ef57289c2b644bf0c7151
SHA1453de8230fb285b86b5d683b85e5346870c42ee6
SHA25626d2466f69af77a9a713bdbc70709871d267b1a462212b90109c283a486fbf2e
SHA51246d4eda77d96ad0579b7cca7d9d57a9b9d961878e71276decb07a89cb944d7c5ff589ec0c6a61f4e10daefcf28d2fb418b9cb500205646a20636822c788c6624
-
Filesize
844KB
MD5b0c7efefb2d6ae286600769343b7da43
SHA16eab2e79eb0e0627751c6bffca70f26842f4086a
SHA25624326e6e4f367b1cdccec384903329b242f9c9c8c213d7f436dc81b7abdac3d0
SHA512571899e7667d6f23520331dae0b0fa5f41f43000120b8d602125ab961af5f9c401ae92e2438f355fc5e3fe4d51c0977491c2dc0716f36eb1f2638b5a26e127e5
-
Filesize
659KB
MD543f066e8824dbedfdb355defc06c3a93
SHA103f7b955fb373687bbe031b2853e7183ca5ea02b
SHA256d7a44825674ce2586c0d5c32274d9e4dd89daccdcc1367fe10c4e3a737c2db21
SHA512ae34fc286b2b75781aec26661085e5d4aad9c0f90ea16a33280db7edef44d8658221a3f20635378912258f697c836cc06def4335f270f053ae5d75d0a6654b07
-
Filesize
520KB
MD51cf926bb8a116d54dae5e33cb2501a84
SHA1c1da9329ac0d4de995489660ef4eae15e6c8ebfc
SHA256791b81464a6618e13c1112e81ecfa64ce37404883f67726111240c338eac829b
SHA512896f99914d231f22632c3191301ef93fbfc86ec45816dca83445b0ea02c7fab9a59df3082277228512d1993cf9ac21d2dbf20e4793fb6d33c8490460dc4ef0e5
-
Filesize
405KB
MD57d262d827ad75741ace041a6b5701883
SHA1195db5ac6cb0121d4a49fe01977a99e3a1c8cce9
SHA2563bf7cb90170d933a133978a4ef3239786a9dd5539e48c5e1fa9a0ef470d055cb
SHA5129b1e97dd201095017fe699a41a3a7728ca725e2aa130a123476528f1e965b0109aca2be17b2fff7fe0bb8a77d73294429db79d8a471312749fb03d751f2937b1
-
Filesize
543KB
MD5e40b35a1ed7e24978a2228b1dbea2051
SHA118669cbcc89c1349f64c2e7bd10b846873689c93
SHA256b3998c103239a1c7baecb9bb05a2d69dfdf854eca3d57fd355a9aff59867bf46
SHA51249b7757df5cad5393efa5eb8924d144017f75f0257a45196527164f339d39090b25f4bbd5076b7dd37ea4a94d5bdbe8f499dc8514c2cc88603b0673f869ee76a
-
Filesize
1016B
MD50e4048ae343932ec4deecd5c28d41120
SHA1d8cba17ad7c4a6c0b69b6e45291bdf64d83fa724
SHA256d12b37982d443bb314d593362d052eba684b200eca1454a7d149d357efe27970
SHA512bd7e2eaf99267bea7be01b6c3cac74e5a0c8337fcf0215c62cea4192f9b6bc0ede3a733d282750693b0c3c7cbb96b63614e12ad5928ceda17fe9c064dec411c9
-
Filesize
853B
MD5e1364886ae80ad259f572645fb45e98b
SHA1132dc959681181e7ab6dd6909046f53c5e9f69ad
SHA256000ae2cfe01b7e4c5b1e01ad1a4c0aa0b223f373a1fecf13b8d052d55f9401a5
SHA512632735d26425c0efa2f6a172625173d0e7bbc2d0b589cf0cfb2a3872a298edac6627596792daf4b3199248bd4fb83ada21a25f738a01b492ed95d19aea40890b
-
Filesize
853B
MD5e1364886ae80ad259f572645fb45e98b
SHA1132dc959681181e7ab6dd6909046f53c5e9f69ad
SHA256000ae2cfe01b7e4c5b1e01ad1a4c0aa0b223f373a1fecf13b8d052d55f9401a5
SHA512632735d26425c0efa2f6a172625173d0e7bbc2d0b589cf0cfb2a3872a298edac6627596792daf4b3199248bd4fb83ada21a25f738a01b492ed95d19aea40890b
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
32KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
-
Filesize
40KB
-
-
-
Filesize
16.0MB
-
Filesize
10.8MB
-
Filesize
16.0MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
