magniber | bc3a0e276a26612ffa45f229b069b624750e2c0737b2af2f934378d85d87a2f9

General

Target

System_Update_Win10.4a4793a31463b.cpl.dll
Size

73KB
MD5

90a417a2f0b30b3fcd7a958edecc5777
SHA1

590d6273e401526c76b4cbe35393e29f400363ae
SHA256

bc3a0e276a26612ffa45f229b069b624750e2c0737b2af2f934378d85d87a2f9
SHA512

a7466139bbc61bb5c36c1d11958ca6e0e4e4608df25d7f6e7c9afb62a72ccb8d2e78a0bfec0cb4b3942ed697be8111dc66405926f4a0f5cda5d8162396ac93b4
SSDEEP

1536:Awnu+nR6RxOZ46S3CTNqF9NyiBrhcw8FBP:fu+u6y0MLyYh8FZ

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5024-135-0x000001AF669E0000-0x000001AF669ED000-memory.dmp	family_magniber
behavioral2/memory/2312-136-0x0000024E75DD0000-0x0000024E75DDB000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Suspicious use of SetThreadContext 13 IoCs

Processes:

rundll32.exe

description	pid	Process
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe
PID 5024 set thread context of 0	5024	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4448	5024	WerFault.exe	57

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
5024	rundll32.exe
5024	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid	Process
3068	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

RuntimeBroker.exeExplorer.EXE

description	pid	Process
Token: SeShutdownPrivilege	3408	RuntimeBroker.exe
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3408	RuntimeBroker.exe
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3068	Explorer.EXE
Token: SeCreatePagefilePrivilege	3068	Explorer.EXE
Token: SeShutdownPrivilege	3408	RuntimeBroker.exe
Token: SeShutdownPrivilege	3408	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 5024 wrote to memory of 2312	5024	rundll32.exe	37
PID 5024 wrote to memory of 2340	5024	rundll32.exe	36
PID 5024 wrote to memory of 2396	5024	rundll32.exe	35
PID 5024 wrote to memory of 3068	5024	rundll32.exe	33
PID 5024 wrote to memory of 2632	5024	rundll32.exe	32
PID 5024 wrote to memory of 3236	5024	rundll32.exe	31
PID 5024 wrote to memory of 3328	5024	rundll32.exe	29
PID 5024 wrote to memory of 3408	5024	rundll32.exe	30
PID 5024 wrote to memory of 3496	5024	rundll32.exe	78
PID 5024 wrote to memory of 3648	5024	rundll32.exe	77
PID 5024 wrote to memory of 4716	5024	rundll32.exe	74
PID 5024 wrote to memory of 1728	5024	rundll32.exe	55

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3328

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2632

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3068
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System_Update_Win10.4a4793a31463b.cpl.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5024 -s 280
    3⤵
    - Program crash
    PID:4448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2340

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2312

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1728

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3648

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 5024 -ip 5024
1⤵
PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-136-0x0000024E75DD0000-0x0000024E75DDB000-memory.dmp

Filesize
44KB

Download
memory/5024-135-0x000001AF669E0000-0x000001AF669ED000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads