Ransom.Win64.MAGNIBER.C

Infection Channel:

Downloaded from the Internet, Dropped by other malware

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It gathers certain information on the affected computer.

It redirects browsers to certain sites. However, as of this writing, the said sites are inaccessible.

It drops files as ransom note.

File Size:

39,424 bytes

File Type:

DLL

Memory Resident:

Yes

Initial Samples Received Date:

01 Nov 2021

Payload:

Connects to URLs/IPs, Drops files, Encrypts files, Displays message/message boxes

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

Display ransom note:
- notepad.exe %Public%\readme.txt
Open payment page through browser:
- cmd /c "start http://{Random characters}kynscshsn.{BLOCKED}s.uno/kynscshsn&{string1}&{string2}&{string3}&{string4}&{string5} "
  - where
%System%\wbem\wmic process call create "vssadmin. exe Delete Shadows /all /quiet" → deletes shadow copies
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"" → If running on Win10
cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"" → if running on Windows versions < Win10

It injects itself into the following processes running in the affected system's memory:

It injects into each process if the ff. criteria is met:
- The process is not iexplore.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

kynscshsn

Other System Modifications

This Ransomware adds the following registry entries:

if running on Win10:
HKEY_CURRENT_USER\Software\Classes\
ms-settings\shell\open\
command
(Default) = regsvr32.exe scrobj.dll /s /u /n /i:%Public%\readme.txt → initial registry entry where file originally contains code to delete shadow files

HKEY_CURRENT_USER\Software\Classes\
ms-settings\shell\open\
command
(Default) = %System%\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"

HKEY_CURRENT_USER\Software\Classes\
ms-settings\shell\open\
command
DelegateExecute = 0

if running on Windows versions < Win10:
HKEY_CURRENT_USER\Software\Classes\
mscfile\shell\open\
command
(Default) = %System%\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"

Propagation

This Ransomware does not have any propagation routine.

Backdoor Routine

This Ransomware does not have any backdoor routine.

Rootkit Capabilities

This Ransomware does not have rootkit capabilities.

Information Theft

This Ransomware gathers the following information on the affected computer:

The number of drives it enumerates
Total size of encrypted data
The number of encrypted files
The number of enumerated files
Build number of the compromised windows operating system

Other Details

This Ransomware encrypts files with the following extensions:

abm
abs
abw
accdb
act
adn
adp
aes
aft
afx
agif
agp
ahd
ai
aic
aim
albm
alf
ans
apd
apm
apng
aps
apt
apx
arc
art
arw
asc
ase
asf
ask
asm
asp
asw
asy
aty
avi
awdb
awp
awt
aww
azz
bad
bak
bay
bbs
bdb
bdp
bdr
bean
bib
bmp
bmx
bna
bnd
boc
bok
brd
brk
brn
brt
bss
btd
bti
btr
c
ca
cals
can
cd
cdb
cdc
cdg
cdmm
cdmt
cdmz
cdr
cdt
cf
cfu
cgm
cimg
cin
cit
ckp
class
clkw
cma
cmx
cnm
cnv
colz
cpc
cpd
cpg
cpp
cps
cpx
crd
crt
crw
cs
csr
csv
csy
ct
cvg
cvi
cvs
cvx
cwt
cxf
cyi
dad
daf
db
dbc
dbf
dbk
dbs
dbt
dbv
dbx
dca
dcb
dch
dcr
dcs
dct
dcx
dd
dds
ded
der
dgn
dgs
dgt
dhs
dib
dif
dip
diz
djv
djvu
dmi
dmo
dnc
dne
doc
docb
docm
docx
docz
dot
dotm
dotx
dpp
dpx
dqy
drw
drz
dsk
dsn
dsv
dt
dta
dtsx
dtw
dv
dvi
dwg
dx
dxb
dxf
eco
ecw
ecx
edb
efd
egc
eio
eip
eit
em
emd
emf
emlx
ep
epf
epp
eps
epsf
eq
erf
err
etf
etx
euc
exr
fa
faq
fax
fb
fbx
fcd
fcf
fdf
fdr
fds
fdt
fdx
fdxt
fes
fft
fi
fic
fid
fif
fig
fla
flr
flv
fmv
fo
fodt
fpos
fpt
fpx
frm
frt
frx
ftn
fwdn
fxc
fxg
fzb
fzv
gcdp
gdb
gdoc
gem
geo
gfb
gfie
ggr
gif
gih
gim
gio
glox
gpd
gpg
gpn
gro
grob
grs
gsd
gthr
gtp
gv
gwi
gz
h
hbk
hdb
hdp
hdr
hht
his
hp
hpg
hpi
hs
htc
hwp
hz
ib
ibd
icn
icon
icpr
idc
idea
idx
igt
igx
ihx
ii
iiq
imd
info
ink
ipf
ipx
iso
itdb
itw
iwi
j
jar
jas
java
jbig
jbmp
jbr
jfif
jia
jis
jng
joe
jpe
jpeg
jpg
jps
jpx
jrtf
js
jsp
jtf
jtx
jw
jxr
kdb
kdbx
kdc
kdi
kdk
kes
key
kic
klg
knt
kon
kpg
kwd
lay
lbm
lbt
ldf
lgc
lis
lit
ljp
lmk
lnt
lrc
lst
ltr
ltx
lue
luf
lwo
lwp
lws
lyt
lyx
ma
mac
man
map
maq
mat
max
mb
mbm
mbox
mdb
mdf
mdn
mdt
me
mef
mel
mft
mgcb
mgmf
mgmt
mgmx
mgtx
mid
min
mkv
mm
mmat
mnr
mnt
mos
mov
mpeg
mpf
mpg
mpo
mrg
mrxs
msg
mud
mwb
mwp
mx
my
myd
myi
ncr
nct
ndf
nef
nfo
njx
nlm
now
nrw
nsf
nyf
nzb
obj
oce
oci
ocr
odb
odg
odm
odo
odp
ods
odt
of
oft
omf
oplc
oqy
ora
orf
ort
orx
ost
ota
otg
oti
otp
ots
ott
ovp
ovr
owc
owg
oyx
ozb
ozj
ozt
p
pa
pan
pano
pap
paq
pas
pbm
pcd
pcs
pdb
pdd
pdf
pdm
pds
pdt
pef
pem
pff
pfi
pfs
pfv
pfx
pgf
pgm
phm
php
pic
pict
pix
pjpg
pjt
plt
pm
pmg
png
pni
pnm
pntg
pnz
pobj
pop
pot
potm
potx
ppam
ppm
pps
ppsm
ppsx
ppt
pptm
pptx
prt
prw
psd
psdx
pse
psid
psp
pst
psw
ptg
pth
ptx
pu
pvj
pvm
pvr
pwa
pwi
pwr
px
pxr
pza
pzp
pzs
qd
qmg
qpx
qry
qvd
rad
rar
ras
raw
rb
rctd
rcu
rd
rdb
rft
rgb
rgf
rib
ric
riff
ris
rix
rle
rli
rng
rpd
rpf
rpt
rri
rs
rsb
rsd
rsr
rst
rt
rtd
rtf
rtx
run
rw
rzk
rzn
saf
sam
sbf
scad
scc
sch
sci
scm
sct
scv
scw
sdb
sdf
sdm
sdoc
sdw
sep
sfc
sfw
sgm
sh
sig
skm
sla
sld
sldm
sldx
slk
sln
sls
smf
sms
snt
sob
spa
spe
sph
spj
spp
spq
spr
sq
sqb
srw
ssa
ssk
st
stc
std
sti
stm
stn
stp
str
stw
sty
sub
suo
svf
svg
svgz
swf
sxc
sxd
sxg
sxi
sxm
sxw
tab
tar
tbk
tcx
tdf
tdt
te
tex
text
tgz
thp
tif
tiff
tlb
tlc
tm
tmd
tmv
tmx
tne
tpc
trm
tvj
udb
ufr
unx
uof
uop
uot
upd
usr
utxt
vb
vbr
vbs
vcd
vct
vdb
vdi
vec
vm
vmdk
vmx
vnt
vob
vpd
vrm
vrp
vsd
vsdm
vsdx
vsm
vstm
vstx
vue
vw
wav
wbk
wcf
wdb
wgz
wire
wks
wma
wmdb
wmv
wn
wp
wpa
wpd
wpg
wps
wpt
wpw
wri
wsc
wsd
wsh
wtx
x
xar
xd
xdb
xlc
xld
xlf
xlgc
xlm
xls
xlsb
xlsm
xlsx
xlt
xltm
xltx
xlw
xps
xwp
xyp
xyw
ya
ybk
ym
zabw
zdb
zdc
zip
zw

It redirects browsers to the following sites:

http://{Random characters}kynscshsn.{BLOCKED}s.uno/kynscshsn&{string1}&{string2}&{string3}&{string4}&{string5} → connects to payment page

However, as of this writing, the said sites are inaccessible.

It does not exploit any vulnerability.

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

documents and settings
appdata
local settings
sample music
sample pictures
sample videos
tor browser
recycle
windows
boot
intel
msocache
perflogs
program files
programdata
recovery
system volume information
winnt

It appends the following extension to the file name of the encrypted files:

.kynscshsn

It drops the following file(s) as ransom note:

%Public%\readme.txt
{Encrypted Directory}\readme.txt

NOTES:

It encrypts available drives

Removable
Remote
Fixed

it avoids encrypting the following files with file attributes:

FILE_ATTRIBUTE_SYSTEM
FILE_ATTRIBUTE_HIDDEN
FILE_ATTRIBUTE_READYONLY
FILE_ATTRIBUTE_TEMPORARY
FILE_ATTRIBUTE_VIRTUAL

It avoids encrypting the following folder with file attributes:

FILE_ATTRIBUTE_SYSTEM
FILE_ATTRIBUTE_HIDDEN
FILE_ATTRIBUTE_ENCRYPTED

Minimum Scan Engine:

9.800

FIRST VSAPI PATTERN FILE:

17.186.03

FIRST VSAPI PATTERN DATE:

11 Nov 2021

VSAPI OPR PATTERN File:

17.187.00

VSAPI OPR PATTERN Date:

12 Nov 2021

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Identify and terminate files detected as Ransom.Win64.MAGNIBER.C

[ Learn More ]

Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command
- (Default) = regsvr32.exe scrobj.dll /s /u /n /i:%Public%\readme.txt
In HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command
- (Default) = %System%\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
In HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command
- DelegateExecute = 0
In HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command
- (Default) = %System%\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"

Step 5

Search and delete these files

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Public%\readme.txt
{Encrypted Directory}\readme.txt

Step 6

Scan your computer with your Trend Micro product to delete files detected as Ransom.Win64.MAGNIBER.C. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Step 7

Restore encrypted files from backup.

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

Ransom.Win64.MAGNIBER.C

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Resources

Support

About Trend

Country Headquarters

The Americas

Middle East & Africa

Europe

Asia & Pacific