magniber | 6a68217b951f9655e4a7ed13fcfc4696ac5d231450fe7d2be8b6a1d71425752c

Analysis

max time kernel
50s
max time network
52s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
15-09-2022 02:02

Target

SYSTEM.Security.Database.Upgrade.Win10.0.jse
Size

185KB
MD5

f6d2fc78661b55258fb704f66c9949e4
SHA1

7c4608440e4afcb032890edd4deef18a0ce3c8dd
SHA256

6a68217b951f9655e4a7ed13fcfc4696ac5d231450fe7d2be8b6a1d71425752c
SHA512

9f66641f19e8046b19f7bffa056ec3e677aae853102dded94c22665381d0d2b65334c16c74d7b64df319b1518931d6ad281ad86c1fbc67ee6ba1984f67506dce
SSDEEP

3072:dthtQYzUz8giIajyEPeR00t/+DYhRkEIKf+6yr3S1IuIDbHBX66vPYH/J25gfgbD:z73zUz8gCjyUeihSRkCy3H36HxgbD

Score

10^/10

Detect magniber ransomware 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1680-124-0x0000022B76EF0000-0x0000022B76F02000-memory.dmp	family_magniber
behavioral1/memory/1680-126-0x0000022B00000000-0x0000022B01000000-memory.dmp	family_magniber
behavioral1/memory/2352-127-0x0000016323980000-0x000001632398A000-memory.dmp	family_magniber
behavioral1/memory/1680-136-0x0000022B00000000-0x0000022B01000000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WScript.exe

pid process

1680 WScript.exe
1680 WScript.exe

pid	process
1680	WScript.exe
1680	WScript.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1680 wrote to memory of 2352	1680	WScript.exe	sihost.exe
PID 1680 wrote to memory of 2360	1680	WScript.exe	svchost.exe
PID 1680 wrote to memory of 2492	1680	WScript.exe	taskhostw.exe
PID 1680 wrote to memory of 3012	1680	WScript.exe	Explorer.EXE
PID 1680 wrote to memory of 3328	1680	WScript.exe	ShellExperienceHost.exe
PID 1680 wrote to memory of 3340	1680	WScript.exe	SearchUI.exe
PID 1680 wrote to memory of 3560	1680	WScript.exe	RuntimeBroker.exe
PID 1680 wrote to memory of 3832	1680	WScript.exe	DllHost.exe

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3328

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3340

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3832

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3560

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2360

memory/1680-124-0x0000022B76EF0000-0x0000022B76F02000-memory.dmp

Filesize
72KB

Download
memory/1680-126-0x0000022B00000000-0x0000022B01000000-memory.dmp

Filesize
16.0MB

Download
memory/1680-136-0x0000022B00000000-0x0000022B01000000-memory.dmp

Filesize
16.0MB

Download
memory/2352-127-0x0000016323980000-0x000001632398A000-memory.dmp

Filesize
40KB

Download