Detect magniber ransomware

Magniber Ransomware

Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

Magniber family

Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Modifies boot configuration data using bcdedit

Renames multiple (88) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Deletes System State backups

Uses wbadmin.exe to inhibit system recovery.