Overview

overview

10

Static

static

1

41ef278a86...3e.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41ef278a866d57e3c81882e4ad7f6d04ae6b066cfd5632120d9ac4332d66753e

  • Size

    96KB

  • Sample

    240523-pcqsdage62

  • MD5

    42ad49ed99c0d41a820316309bc2c3b3

  • SHA1

    f447a72b3cbea72e1b56fda8f44fd9f304b4474a

  • SHA256

    41ef278a866d57e3c81882e4ad7f6d04ae6b066cfd5632120d9ac4332d66753e

  • SHA512

    4e0af295dc656ad70361363c77646fb899a1ff4a816790959e090125bdba2089eb058dfa2b18bdcede34b45d9420b6f57c0db6aefa32f9799eccec3f163bdf75

  • SSDEEP

    1536:kiqCWq/Gf2CJ7ZrhzZr98n+lW0D80D+7fxun:xqCWqu+q8nLLxun

Score
10/10
magniberdefense_evasionexecutionimpactransomware

Malware Config

Targets

    • Target

      41ef278a866d57e3c81882e4ad7f6d04ae6b066cfd5632120d9ac4332d66753e

    • Size

      96KB

    • MD5

      42ad49ed99c0d41a820316309bc2c3b3

    • SHA1

      f447a72b3cbea72e1b56fda8f44fd9f304b4474a

    • SHA256

      41ef278a866d57e3c81882e4ad7f6d04ae6b066cfd5632120d9ac4332d66753e

    • SHA512

      4e0af295dc656ad70361363c77646fb899a1ff4a816790959e090125bdba2089eb058dfa2b18bdcede34b45d9420b6f57c0db6aefa32f9799eccec3f163bdf75

    • SSDEEP

      1536:kiqCWq/Gf2CJ7ZrhzZr98n+lW0D80D+7fxun:xqCWqu+q8nLLxun

    Score
    10/10
    magniberdefense_evasionexecutionimpactransomware

    • Detect magniber ransomware

    • Magniber Ransomware

      Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

      ransomwaremagniber

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (86) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks