Analysis
-
max time kernel
158s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-09-2022 13:08
General
-
Target
SYSTEM.Critical.Upgrade.Win10.0.ba45bd8ee89b1.js
-
Size
217KB
-
MD5
0fd4c12239b945723e6c622d48f07979
-
SHA1
22cbc2c26832c8c3dd4be9c7fe6bbe94dbfbcdb2
-
SHA256
dfa32d8ed7c429b020c0581148a55bc752c35834d7a2b1bae886f2b436285c94
-
SHA512
a37affd28bc088ff6a27ac22e69e2479c2b4eeb015fd8d284097ce174f2ca6af87719b205d0e9fb5e6b3bfcf4bfb7fd21f64956eb173adfe854b3dc10db3c40b
-
SSDEEP
1536:t0AGu7QKLA6Yw14Gl1SSHwb5Wo3ayPu8Iow7of50bgd0BwNH2UB7zyigICK5iu/d:6Tmp25gfWPV
Malware Config
Signatures
-
Detect magniber ransomware 3 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 42 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Modifies registry class
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3284 -s 4042⤵
- Program crash
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
- Modifies extensions of user files
- Modifies registry class
-
C:\Windows\System32\cmd.exe/c fodhelper.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\fodhelper.exefodhelper.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exe"wscript.exe" /B /E:VBScript.Encode ../../Users/Public/cakgyhvwp.tex4⤵
-
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SYSTEM.Critical.Upgrade.Win10.0.ba45bd8ee89b1.js2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 3284 -ip 32841⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no1⤵
- Process spawned unexpected child process
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet1⤵
- Process spawned unexpected child process
- Deletes backup catalog
-
C:\Windows\system32\wbadmin.exewbadmin delete systemstatebackup -quiet1⤵
- Process spawned unexpected child process
- Deletes System State backups
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
869B
MD5b36267cac60eabc0d2df92f48e50290a
SHA1e61d05db92f8d41f64fe9c615cdc0bd7bd8cc55d
SHA256160042070c4e8cb3bd76f1d36841d8967534ea2311ac062ab82e17a90c29cdfd
SHA512e366e4ccc6bbc004cca3ac612eefc1097bc164a7ac205a45abba71a551579b4c944311ef7206f443d4edf3217f280dbeaa9aaba7ab1b3a32d784e34fa043ef5b
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.5MB
-
Filesize
5.2MB
-
Filesize
44KB
-
Filesize
10.8MB
-
Filesize
44KB
-
Filesize
40KB
-
-