Ransom.Win64.MAGNIBER.YXCFF

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be injected into processes running in memory.

It is capable of encrypting files in the affected system.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/{random}
• "%System%\vssadmin.exe" Delete Shadows /all /quiet
• "%System%\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
• "%System%\bcdedit.exe" /set {default} recoveryenabled no
• "%System%\wbadmin.exe" delete catalog -quiet
• "%System%\wbadmin.exe" delete systemstatebackup -quiet
• "%System%\fodhelper.exe"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It may be injected into processes running in memory.

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Classes\
ms-settings\shell\open\
command
(Default) = regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/{random}

Other Details

This Ransomware connects to the following possibly malicious URL:

• {BLOCKED}.fightof.info/ytxaifbnj{random}

It is capable of encrypting files in the affected system.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .ytxaifbnj

It drops the following file(s) as ransom note:

• README.html