General
- Target 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66.fpx
- Size 164KB
- Sample260415-we93csfv6n
- SHA256 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66
Score
10/10
Malware Config
Targets
-
- Target 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66.fpx
- Size 164KB
- SHA256 0e65657740d7f06acda53b7d3190f9728801b984d5bd6ccb0b865d218ae71f66
Score10/10-
Detect magniber ransomware
-
Family: Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (89) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
System Binary Proxy Execution: Regsvr32
Abuse Regsvr32 to proxy execution of malicious code.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2System Binary Proxy Execution
2Msiexec
1Regsvr32
1