magniber | 9095bbb4b123a353a856634166f193124bdc4591cb3a38922b2283acc1d966d6

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Antivirus_Upgrade_Cloud.b79e8f66eb124.jse
Size

186KB
MD5

871d0084a53bb7733346b167f7e67e36
SHA1

2b75f4d60b357ea3cdd53a73e8dd00148fea0889
SHA256

9095bbb4b123a353a856634166f193124bdc4591cb3a38922b2283acc1d966d6
SHA512

b77f916dfe0fa3ebcd7ca7fef2df57d9e3e647a37ee90e5bdf845cc715f2ad58f7c3053d55b43d108da004ea1097826ad7dca7fde5f6f45bcb6781acbe68ddaf
SSDEEP

3072:S7e1lcDeY9tstU6UtjvN7MLFfOVMumRRCivI7lvLAe25gfV99p:S4uDBtstmtJouig7V99p

Score

10^/10

magniber evasion ransomware

Malware Config

Signatures

Detect magniber ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5036-134-0x000001AA00000000-0x000001AA01000000-memory.dmp	family_magniber
behavioral2/memory/2832-135-0x000001C713670000-0x000001C71367A000-memory.dmp	family_magniber
behavioral2/memory/5036-148-0x000001AA00000000-0x000001AA01000000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

bcdedit.exebcdedit.exewbadmin.exewbadmin.exebcdedit.exebcdedit.exewbadmin.exewbadmin.exebcdedit.exewbadmin.exebcdedit.exewbadmin.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	1688	wbadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1688	wbadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1688	wbadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	1688	wbadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	1688	wbadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	1688	bcdedit.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	1688	wbadmin.exe

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

1796 bcdedit.exe
4556 bcdedit.exe
4248 bcdedit.exe
2324 bcdedit.exe
272 bcdedit.exe
288 bcdedit.exe
Deletes System State backups 3 TTPs 3 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exewbadmin.exe

pid process

4292 wbadmin.exe
2828 wbadmin.exe
3444 wbadmin.exe
Deletes backup catalog 3 TTPs 3 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exewbadmin.exe

pid process

3692 wbadmin.exe
2184 wbadmin.exe
3808 wbadmin.exe

pid	process
1796	bcdedit.exe
4556	bcdedit.exe
4248	bcdedit.exe
2324	bcdedit.exe
272	bcdedit.exe
288	bcdedit.exe

pid	process
4292	wbadmin.exe
2828	wbadmin.exe
3444	wbadmin.exe

pid	process
3692	wbadmin.exe
2184	wbadmin.exe
3808	wbadmin.exe

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\StepNew.tiff	svchost.exe
File renamed	C:\Users\Admin\Pictures\StepNew.tiff => C:\Users\Admin\Pictures\StepNew.tiff.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\TestUnprotect.tiff => C:\Users\Admin\Pictures\TestUnprotect.tiff.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromApprove.crw => C:\Users\Admin\Pictures\ConvertFromApprove.crw.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\FindLimit.tif => C:\Users\Admin\Pictures\FindLimit.tif.gpbaiwzt	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\MergeRestart.tiff	svchost.exe
File renamed	C:\Users\Admin\Pictures\MergeRestart.tiff => C:\Users\Admin\Pictures\MergeRestart.tiff.gpbaiwzt	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\TestUnprotect.tiff	svchost.exe
File renamed	C:\Users\Admin\Pictures\CloseOpen.crw => C:\Users\Admin\Pictures\CloseOpen.crw.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\OptimizeExpand.crw => C:\Users\Admin\Pictures\OptimizeExpand.crw.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\ApproveStop.tif => C:\Users\Admin\Pictures\ApproveStop.tif.gpbaiwzt	svchost.exe
File renamed	C:\Users\Admin\Pictures\RemoveUnpublish.tif => C:\Users\Admin\Pictures\RemoveUnpublish.tif.gpbaiwzt	svchost.exe

Drops file in Windows directory 6 IoCs

Processes:

wbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4928 3276 WerFault.exe DllHost.exe

pid	pid_target	process	target process
4928	3276	WerFault.exe	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies registry class 42 IoCs

Processes:

svchost.exesihost.exetaskhostw.exeRuntimeBroker.exeRuntimeBroker.exeRuntimeBroker.exeExplorer.EXEsvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/reovgnwbjymr.dd"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/tlalnak.dd"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/ajcqdaulzl.dd"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/pkdraxukxvm.dd"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/brkvvljvs.dd"	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/wgnqxdhlpv.dd"	taskhostw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/qiznxoynrf.dd"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\ = "wscript.exe /B /E:VBScript.Encode ../../Users/Public/xyorjwvmlmgv.dd"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\Shell\open\command\DelegateExecute	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer\ = "AppX0enk2acdsmv8ydhntbtea6yjp27223q6"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\ms-settings\CurVer	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WScript.exe

pid process

5036 WScript.exe
5036 WScript.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

760 Explorer.EXE

pid	process
5036	WScript.exe
5036	WScript.exe

pid	process
760	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXERuntimeBroker.exevssvc.exewbengine.exe

description	pid	process
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	3428	RuntimeBroker.exe
Token: SeShutdownPrivilege	3428	RuntimeBroker.exe
Token: SeBackupPrivilege	3684	vssvc.exe
Token: SeRestorePrivilege	3684	vssvc.exe
Token: SeAuditPrivilege	3684	vssvc.exe
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeBackupPrivilege	4400	wbengine.exe
Token: SeRestorePrivilege	4400	wbengine.exe
Token: SeSecurityPrivilege	4400	wbengine.exe
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE
Token: SeShutdownPrivilege	760	Explorer.EXE
Token: SeCreatePagefilePrivilege	760	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

WScript.execmd.exefodhelper.execmd.exefodhelper.execmd.exefodhelper.execmd.exefodhelper.execmd.exefodhelper.exe

description	pid	process	target process
PID 5036 wrote to memory of 2832	5036	WScript.exe	sihost.exe
PID 5036 wrote to memory of 2852	5036	WScript.exe	svchost.exe
PID 5036 wrote to memory of 2944	5036	WScript.exe	taskhostw.exe
PID 5036 wrote to memory of 760	5036	WScript.exe	Explorer.EXE
PID 5036 wrote to memory of 3024	5036	WScript.exe	svchost.exe
PID 5036 wrote to memory of 3276	5036	WScript.exe	DllHost.exe
PID 5036 wrote to memory of 3368	5036	WScript.exe	StartMenuExperienceHost.exe
PID 5036 wrote to memory of 3428	5036	WScript.exe	RuntimeBroker.exe
PID 5036 wrote to memory of 3528	5036	WScript.exe	SearchApp.exe
PID 5036 wrote to memory of 3652	5036	WScript.exe	RuntimeBroker.exe
PID 5036 wrote to memory of 4748	5036	WScript.exe	RuntimeBroker.exe
PID 5036 wrote to memory of 2864	5036	WScript.exe	backgroundTaskHost.exe
PID 3708 wrote to memory of 704	3708	cmd.exe	fodhelper.exe
PID 3708 wrote to memory of 704	3708	cmd.exe	fodhelper.exe
PID 704 wrote to memory of 3136	704	fodhelper.exe	wscript.exe
PID 704 wrote to memory of 3136	704	fodhelper.exe	wscript.exe
PID 2564 wrote to memory of 1332	2564	cmd.exe	fodhelper.exe
PID 2564 wrote to memory of 1332	2564	cmd.exe	fodhelper.exe
PID 1332 wrote to memory of 2672	1332	fodhelper.exe	wscript.exe
PID 1332 wrote to memory of 2672	1332	fodhelper.exe	wscript.exe
PID 2224 wrote to memory of 572	2224	cmd.exe	fodhelper.exe
PID 2224 wrote to memory of 572	2224	cmd.exe	fodhelper.exe
PID 572 wrote to memory of 2300	572	fodhelper.exe	wscript.exe
PID 572 wrote to memory of 2300	572	fodhelper.exe	wscript.exe
PID 5028 wrote to memory of 4284	5028	cmd.exe	fodhelper.exe
PID 5028 wrote to memory of 4284	5028	cmd.exe	fodhelper.exe
PID 4284 wrote to memory of 3960	4284	fodhelper.exe	wscript.exe
PID 4284 wrote to memory of 3960	4284	fodhelper.exe	wscript.exe
PID 2140 wrote to memory of 3608	2140	cmd.exe	fodhelper.exe
PID 2140 wrote to memory of 3608	2140	cmd.exe	fodhelper.exe
PID 3608 wrote to memory of 4708	3608	fodhelper.exe	wscript.exe
PID 3608 wrote to memory of 4708	3608	fodhelper.exe	wscript.exe

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3428
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/qiznxoynrf.dd
      4⤵
      PID:2672

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:2864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4748
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/reovgnwbjymr.dd
      4⤵
      PID:4708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:3652

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Antivirus_Upgrade_Cloud.b79e8f66eb124.jse"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3276 -s 936
  2⤵
  - Program crash
  PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Modifies registry class
PID:3024
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/reovgnwbjymr.dd
      4⤵
      PID:3960

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:760
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/reovgnwbjymr.dd
      4⤵
      PID:2300

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Modifies registry class
PID:2944
- C:\Windows\System32\cmd.exe
  /c fodhelper.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\System32\fodhelper.exe
    fodhelper.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Windows\system32\wscript.exe
      "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/qiznxoynrf.dd
      4⤵
      PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Modifies extensions of user files
- Modifies registry class
PID:2852

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:2832

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 3276 -ip 3276
1⤵
PID:4916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3684

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:1796

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:4556

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
PID:4292

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:3692

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2592

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4092

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:4248

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:2324

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:2184

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
- Drops file in Windows directory
PID:2828

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:272

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
1⤵
- Process spawned unexpected child process
- Deletes backup catalog
PID:3808

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
PID:288

C:\Windows\system32\wbadmin.exe
wbadmin delete systemstatebackup -quiet
1⤵
- Process spawned unexpected child process
- Deletes System State backups
- Drops file in Windows directory
PID:3444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\qiznxoynrf.dd

Filesize
857B

MD5
b179b9ad7d9523ca77a96719ed849079

SHA1
9bad1bcc6484428080fb03d22b079c0fda4985b2

SHA256
d6d195a21b9c7174293c0ada29c421199b6fdca4e009b8905dcbb9f0161db9a2

SHA512
162dfb7cc03e6ab7fb9afa005a01cd525806cb513e97b8b49a7f170a62f12a10ebf3529c9a4f7f28e61afe88c7a1f11d2004d3e37c502316c9c99ba0a72033e7

Download Submit
C:\Users\Public\reovgnwbjymr.dd

Filesize
857B

MD5
b179b9ad7d9523ca77a96719ed849079

SHA1
9bad1bcc6484428080fb03d22b079c0fda4985b2

SHA256
d6d195a21b9c7174293c0ada29c421199b6fdca4e009b8905dcbb9f0161db9a2

SHA512
162dfb7cc03e6ab7fb9afa005a01cd525806cb513e97b8b49a7f170a62f12a10ebf3529c9a4f7f28e61afe88c7a1f11d2004d3e37c502316c9c99ba0a72033e7

Download Submit
memory/572-174-0x0000000000000000-mapping.dmp

Download
memory/704-150-0x0000000000000000-mapping.dmp

Download
memory/760-173-0x0000000008450000-0x0000000008460000-memory.dmp

Filesize
64KB

Download
memory/760-194-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-199-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-155-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-156-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-157-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-158-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-159-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-160-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-161-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-162-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-163-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-164-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-165-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-198-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-167-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-168-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-169-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-170-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-171-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-172-0x0000000008450000-0x0000000008460000-memory.dmp

Filesize
64KB

Download
memory/760-200-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-166-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-202-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/760-184-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-197-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-178-0x0000000008450000-0x0000000008460000-memory.dmp

Filesize
64KB

Download
memory/760-179-0x0000000008450000-0x0000000008460000-memory.dmp

Filesize
64KB

Download
memory/760-180-0x0000000008450000-0x0000000008460000-memory.dmp

Filesize
64KB

Download
memory/760-196-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-201-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/760-195-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-193-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-185-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-186-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-187-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-188-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-189-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-190-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-191-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/760-192-0x0000000008410000-0x0000000008420000-memory.dmp

Filesize
64KB

Download
memory/1332-153-0x0000000000000000-mapping.dmp

Download
memory/2300-175-0x0000000000000000-mapping.dmp

Download
memory/2672-154-0x0000000000000000-mapping.dmp

Download
memory/2832-135-0x000001C713670000-0x000001C71367A000-memory.dmp

Filesize
40KB

Download
memory/3136-151-0x0000000000000000-mapping.dmp

Download
memory/3608-181-0x0000000000000000-mapping.dmp

Download
memory/3960-177-0x0000000000000000-mapping.dmp

Download
memory/4284-176-0x0000000000000000-mapping.dmp

Download
memory/4708-182-0x0000000000000000-mapping.dmp

Download
memory/5036-133-0x00007FFF7B840000-0x00007FFF7C301000-memory.dmp

Filesize
10.8MB

Download
memory/5036-134-0x000001AA00000000-0x000001AA01000000-memory.dmp

Filesize
16.0MB

Download
memory/5036-146-0x00007FFF7B840000-0x00007FFF7C301000-memory.dmp

Filesize
10.8MB

Download
memory/5036-148-0x000001AA00000000-0x000001AA01000000-memory.dmp

Filesize
16.0MB

Download
memory/5036-149-0x00007FFF7B840000-0x00007FFF7C301000-memory.dmp

Filesize
10.8MB

Download