Detect magniber ransomware

Magniber Ransomware

Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Renames multiple (105) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

System Binary Proxy Execution: Regsvr32

Abuse Regsvr32 to proxy execution of malicious code.