Analysis
-
max time kernel
0s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 15:27
General
-
Target
759c06eedcadd60ebd2aa3790eefa40d505044080cea4e1477d845611f322b4c.dll
-
Size
38KB
-
MD5
1f837affe14eeee652ae0271f0cb3804
-
SHA1
5f55dad94a03100542c61777233f7846f9376625
-
SHA256
759c06eedcadd60ebd2aa3790eefa40d505044080cea4e1477d845611f322b4c
-
SHA512
a620bbb9b59fa93cff35d95c6c2000226361fcbcb869d4ec300caec97723802516a430d663e26c129b8c42f1ef9c27b90963896ac86207c7193513567850691b
-
SSDEEP
768:FGcHvpu++E69ZxPGlISQAtxaYzUmFCL+4pO6Dzhc:Fju++E6XxPGlISR5UmoLTO2+
Score
10/10
Malware Config
Signatures
-
Detect magniber ransomware 1 IoCs
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\759c06eedcadd60ebd2aa3790eefa40d505044080cea4e1477d845611f322b4c.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB