Overview

overview

10

Static

static

Antivirus_...ab.jse

windows7-x64

10

Antivirus_...ab.jse

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2022 12:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Antivirus_Upgrade_Cloud.e2550b79e6f94ab.jse

  • Size

    167KB

  • MD5

    b901b278c04a64daf3622012224a8cca

  • SHA1

    0fd90e8962a3a87f10af4448250c85bda8ff48b7

  • SHA256

    56d301fe7a6b1a9e21898162b0dada9ff12878c539591052919fabcc36d28541

  • SHA512

    e648d2ae461aa71fdc578c41626a90f501bd24e5b42fa140deb886ae1091019a5fce75a58b81489225510856555902656da3ed6f4cebbcbab66ffe1872cfdaf3

  • SSDEEP

    3072:p6U8hsMvboPvqad0Y3mrTGCsmf+W0zwA0yX7AzmipeUph59pMhDhTfPDh3GZbrtc:pMvboPaY3r7W0zsOAzrqV5Tg3on1e7xS

Score
10/10
magniberevasionpersistenceransomware

Malware Config

Signatures

  • Detect magniber ransomware 2 IoCs
  • Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 3 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 3 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies extensions of user files
    • Modifies registry class
    PID:2480
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
    • Modifies registry class
    PID:2492
    • C:\Windows\System32\cmd.exe
      /c fodhelper.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\System32\fodhelper.exe
        fodhelper.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Windows\system32\wscript.exe
          "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/lctdobqerbp.ozb
          4⤵
            PID:896
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      1⤵
      • Modifies registry class
      PID:2620
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3456
      • C:\Windows\System32\cmd.exe
        /c fodhelper.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\System32\fodhelper.exe
          fodhelper.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4504
          • C:\Windows\system32\wscript.exe
            "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/oaqenlhzk.ozb
            4⤵
              PID:4660
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3380
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:3292
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3292 -s 836
              2⤵
              • Program crash
              PID:912
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
            1⤵
            • Modifies registry class
            PID:3092
            • C:\Windows\System32\cmd.exe
              /c fodhelper.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1052
              • C:\Windows\System32\fodhelper.exe
                fodhelper.exe
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4712
                • C:\Windows\system32\wscript.exe
                  "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/oaqenlhzk.ozb
                  4⤵
                    PID:1508
            • C:\Windows\Explorer.EXE
              C:\Windows\Explorer.EXE
              1⤵
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2576
              • C:\Windows\System32\WScript.exe
                C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Local\Temp\Antivirus_Upgrade_Cloud.e2550b79e6f94ab.jse"
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1224
              • C:\Windows\System32\cmd.exe
                /c fodhelper.exe
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3260
                • C:\Windows\System32\fodhelper.exe
                  fodhelper.exe
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4312
                  • C:\Windows\system32\wscript.exe
                    "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/oaqenlhzk.ozb
                    4⤵
                      PID:1404
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 2576 -s 5616
                  2⤵
                  • Program crash
                  PID:3824
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                • Modifies registry class
                PID:4568
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                • Modifies registry class
                PID:3696
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3556
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 460 -p 3292 -ip 3292
                  1⤵
                    PID:4084
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2248
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    1⤵
                    • Process spawned unexpected child process
                    • Modifies boot configuration data using bcdedit
                    PID:3660
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled no
                    1⤵
                    • Process spawned unexpected child process
                    • Modifies boot configuration data using bcdedit
                    PID:3504
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete systemstatebackup -quiet
                    1⤵
                    • Process spawned unexpected child process
                    • Deletes System State backups
                    PID:1296
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    1⤵
                    • Process spawned unexpected child process
                    • Deletes backup catalog
                    PID:3248
                  • C:\Windows\system32\wbengine.exe
                    "C:\Windows\system32\wbengine.exe"
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1972
                  • C:\Windows\System32\vdsldr.exe
                    C:\Windows\System32\vdsldr.exe -Embedding
                    1⤵
                      PID:4740
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:2644
                    • C:\Windows\system32\bcdedit.exe
                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                      1⤵
                      • Process spawned unexpected child process
                      • Modifies boot configuration data using bcdedit
                      PID:1908
                    • C:\Windows\system32\bcdedit.exe
                      bcdedit /set {default} recoveryenabled no
                      1⤵
                      • Process spawned unexpected child process
                      • Modifies boot configuration data using bcdedit
                      PID:3884
                    • C:\Windows\system32\wbadmin.exe
                      wbadmin delete catalog -quiet
                      1⤵
                      • Process spawned unexpected child process
                      • Deletes backup catalog
                      PID:4736
                    • C:\Windows\system32\wbadmin.exe
                      wbadmin delete systemstatebackup -quiet
                      1⤵
                      • Process spawned unexpected child process
                      • Deletes System State backups
                      • Drops file in Windows directory
                      PID:1224
                    • C:\Windows\system32\bcdedit.exe
                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                      1⤵
                      • Process spawned unexpected child process
                      • Modifies boot configuration data using bcdedit
                      PID:3532
                    • C:\Windows\system32\bcdedit.exe
                      bcdedit /set {default} recoveryenabled no
                      1⤵
                      • Process spawned unexpected child process
                      • Modifies boot configuration data using bcdedit
                      PID:3136
                    • C:\Windows\system32\wbadmin.exe
                      wbadmin delete systemstatebackup -quiet
                      1⤵
                      • Process spawned unexpected child process
                      • Deletes System State backups
                      PID:2728
                    • C:\Windows\system32\wbadmin.exe
                      wbadmin delete catalog -quiet
                      1⤵
                      • Process spawned unexpected child process
                      • Deletes backup catalog
                      PID:4952
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 444 -p 2576 -ip 2576
                      1⤵
                        PID:3596
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:4128
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3204
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Enumerates system info in registry
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2744

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\USERS\ADMIN\DESKTOP\EXITREVOKE.JFIF.NFQRCABFI
                        Filesize

                        256KB

                        MD5

                        a4e1627b631960d3964369ca5fccb7af

                        SHA1

                        08b10fddbe3e5755b8df8380420e9af768ca1622

                        SHA256

                        36f25a5fd55816cf9a306990726edacb5908d9365b82d367c2f695e534cc9a55

                        SHA512

                        12410c41f99a13dd7dd4faaf9d1d87358b11681eeb5e5e7f664ae215ba8069ee4e990de7efba74442c1bd655b6ef7eebd04808c9a2fd6d311c907e68a8a82e68

                        Download Submit

                      • C:\USERS\ADMIN\DESKTOP\GETLOCK.TIF.NFQRCABFI
                        Filesize

                        153KB

                        MD5

                        fab3cd8aed7e61859d17aac5931d51cd

                        SHA1

                        d91cd1c9ce9235fdd5719f909e20fadcb5f2d387

                        SHA256

                        f724f54e7f8cdc724c5e72ba70ebb837fd032d2e1a5bc146f411b403f120f70d

                        SHA512

                        604c368da679772a6f6ba8caf51f6596c34d4b41cd439f5e26f6a1d7d449e429743366b61abaaa95a4af6c4ef285700d4b68a80a6cef910ec17fe1d19e25448c

                        Download Submit

                      • C:\USERS\ADMIN\DESKTOP\README.HTML
                        Filesize

                        15KB

                        MD5

                        c1ecb81864c38f04fad5c9b03735a939

                        SHA1

                        9ab02a98a5d77c0f17c55bc1a50a20a04cbc93f7

                        SHA256

                        da5e1c87f602c1ad86ba56bbd701fd1b869e05232ca6ee0a39daa155ec0dc379

                        SHA512

                        03bfbbd0d1968b9058273fa2a346dd6f7d3fc2b0f7a44be9d42a4e94d490175178d0a4da443e7997e33b2d5a4432d59b342370553797839da477b577d732b1a5

                        Download Submit

                      • C:\USERS\ADMIN\DESKTOP\READRESTART.POT.NFQRCABFI
                        Filesize

                        345KB

                        MD5

                        90278c344bf7b056cfa17599e5a120d0

                        SHA1

                        a1228042edd5dfba535db22163545da3a48963e4

                        SHA256

                        75862887c3d50b6a4a6f583a65b902cb1caf3bcd040ebf80e8352c8f94f28151

                        SHA512

                        e0dcb8fb946ef9e628cae5c110107317fc6b3ce7dce4bce2f461c5135a5e1ad720d151541a697b0ea61970c44b4e0d93834501c72b49013856ec27a149eb961d

                        Download Submit

                      • C:\USERS\ADMIN\DESKTOP\REQUESTUPDATE.RLE.NFQRCABFI
                        Filesize

                        294KB

                        MD5

                        d6814e056ac59e3810837e64da158b91

                        SHA1

                        5e9ad4515ea6f74a1c478a4888c96cf66270762a

                        SHA256

                        b430ea21e13c201576f846bbdec69477d75ebd2a9bfa44ec946a7f6d8f22b852

                        SHA512

                        6f795cd44cd4ca0f9997506376fa7b3bbf642f7cfe924e4f3f8943305f398cb8efdf02097a80f59d411139176ef8ebf393c743a3e3e57c75f716c0b7bea25679

                        Download Submit

                      • C:\USERS\ADMIN\DESKTOP\UNDOMERGE.NFO.NFQRCABFI
                        Filesize

                        269KB

                        MD5

                        fbfa3d3a68fb1bd8d2844d6685713abc

                        SHA1

                        57e2cc056f52044db7ca34c65be2f5b7e0ceb88e

                        SHA256

                        cea0aa79dac5d6f3fa7223a1a37780c16a3a2688a51f0a66ba1cbe3a34ed953e

                        SHA512

                        ece95f3c3c85fcff72002d5857453e0aae42f500b6c474ff3090439fb05b332a7d09909593356ad991727c8973a3fb34fdccd2647686670f031a07a80ed02f63

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                        Filesize

                        1022B

                        MD5

                        26e62379b96b90a48b2a4da80ad7b5a5

                        SHA1

                        c5b0a0ebe6a43d1069ff0fed58aa9e8232d8da7c

                        SHA256

                        4d1f241bae1b1a191ffa4d36ae59d29cbb0a5162c3128d4e2a4da89b95c97351

                        SHA512

                        18f708ddf624c930cf68077a2b7d8ef62ccf603e9b20882d0d8a5d035a8caf19b569c1fee9fdda1a79844f212d2f2419188210b09cbb3c684e78afc9cef9c036

                        Download Submit

                      • C:\Users\Public\lctdobqerbp.ozb
                        Filesize

                        872B

                        MD5

                        6c7c0ca02f9309ee714ad4e3ddc88522

                        SHA1

                        b770120c20761a6e8f748de49fb05c8820509189

                        SHA256

                        1fcd1713b7a3de5dcdf51e61e9b2cec6c284e14c9791c502295c73161d5914b9

                        SHA512

                        3290b59cac4efa045fa5744586d66a90a00093b9451399fb05dac4b0318e4e92fdb98730b3b01dd97be5536e62a1570958883fff38f55cae781c69ea9b8ded48

                        Download Submit

                      • C:\Users\Public\oaqenlhzk.ozb
                        Filesize

                        872B

                        MD5

                        6c7c0ca02f9309ee714ad4e3ddc88522

                        SHA1

                        b770120c20761a6e8f748de49fb05c8820509189

                        SHA256

                        1fcd1713b7a3de5dcdf51e61e9b2cec6c284e14c9791c502295c73161d5914b9

                        SHA512

                        3290b59cac4efa045fa5744586d66a90a00093b9451399fb05dac4b0318e4e92fdb98730b3b01dd97be5536e62a1570958883fff38f55cae781c69ea9b8ded48

                        Download Submit

                      • memory/896-149-0x0000000000000000-mapping.dmp

                        Download

                      • memory/1224-132-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/1224-147-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/1224-146-0x00007FF8148F0000-0x00007FF8153B1000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/1224-134-0x00000155DEE00000-0x00000155DFE00000-memory.dmp

                        Filesize

                        16.0MB

                        Download

                      • memory/1404-157-0x0000000000000000-mapping.dmp

                        Download

                      • memory/1508-154-0x0000000000000000-mapping.dmp

                        Download

                      • memory/2480-135-0x0000021FE0B20000-0x0000021FE0B2A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/2744-184-0x000001D9AA40C000-0x000001D9AA410000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-185-0x000001D9AA40C000-0x000001D9AA410000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-197-0x000001D9AA404000-0x000001D9AA407000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/2744-196-0x000001D9AA404000-0x000001D9AA407000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/2744-195-0x000001D9AA404000-0x000001D9AA407000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/2744-174-0x000001D9A7530000-0x000001D9A7538000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/2744-175-0x000001D9A8830000-0x000001D9A8850000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/2744-177-0x000001D9AA060000-0x000001D9AA080000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/2744-182-0x000001D9AA40C000-0x000001D9AA410000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-183-0x000001D9AA40C000-0x000001D9AA410000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-194-0x000001D9AA404000-0x000001D9AA407000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/2744-192-0x000001D9AA400000-0x000001D9AA404000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-186-0x000001D9AA40C000-0x000001D9AA410000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-189-0x000001D9AA400000-0x000001D9AA404000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-190-0x000001D9AA400000-0x000001D9AA404000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/2744-191-0x000001D9AA400000-0x000001D9AA404000-memory.dmp

                        Filesize

                        16KB

                        Download

                      • memory/3888-148-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4312-156-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4504-151-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4660-152-0x0000000000000000-mapping.dmp

                        Download

                      • memory/4712-153-0x0000000000000000-mapping.dmp

                        Download