Magniber Ransomware Used a Variant of Microsoft SmartScreen Bypass with Malformed Signature

Indicators of Compromise

Notes

<b>Conclusions</b><div>Magniber operators seem to be ramping up their attacks to target Windows-based systems. We recommend that home users take regular backups of their important files and, if possible, store critical data on isolated storage devices. In addition, it should be ensured that there is no virus infection during the backup process.<br></div><div><br></div>

Mitigation

<div id="subtechniques-card-body" class="card-body p-0 collapse show" style="box-sizing: border-box; flex: 1 1 auto; padding: 0px !important;"><b>Table 1. MITRE ATT&amp;CK Tactics and Techniques</b><br></div><div id="subtechniques-card-body" class="card-body p-0 collapse show" style="box-sizing: border-box; flex: 1 1 auto; padding: 0px !important;"><b><br></b></div><div id="subtechniques-card-body" class="card-body p-0 collapse show" style="box-sizing: border-box; flex: 1 1 auto; padding: 0px !important;"><table class="otherTable" cellspacing="0" cellpadding="4" style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; color: rgb(0, 0, 0); font-family: TXOneFont, sans-serif; font-size: 16px; font-variant-ligatures: none; width: 750px; height: 651px;"><tbody style="background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td rowspan="2" width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(204, 204, 204);"><span style="font-weight: 700;">MITRE Tactics</span></td><td colspan="2" width="36%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(204, 204, 204);"><span style="font-weight: 700;">MITRE Techniques</span></td><td rowspan="2" width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(204, 204, 204);"><span style="font-weight: 700;">Description</span></td></tr><tr style="border-width: 1px 1px 0px; border-top-style: solid; border-right-style: solid; border-bottom-style: initial; border-left-style: solid; border-top-color: rgb(238, 238, 238); border-right-color: rgb(238, 238, 238); border-bottom-color: initial; border-left-color: rgb(238, 238, 238); border-image: initial; background: rgb(238, 238, 238);"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">ID</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Techniques</td></tr><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td rowspan="2" width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Execution</td><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">T1204.002</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">User Execution–Malicious File</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Magniber disguises itself as a .msi file software installer to lure users into opening it.</td></tr><tr style="border-width: 1px 1px 0px; border-top-style: solid; border-right-style: solid; border-bottom-style: initial; border-left-style: solid; border-top-color: rgb(238, 238, 238); border-right-color: rgb(238, 238, 238); border-bottom-color: initial; border-left-color: rgb(238, 238, 238); border-image: initial; background: rgb(238, 238, 238);"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">T1106</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Native API</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Magniber uses native Windows syscalls to make analysis more difficult.</td></tr><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td rowspan="3" width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Privilege Escalation</td><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">T1055.009</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Thread Execution Hijacking</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Magniber enumerates processes and injects shellcode into them to execute encryption with higher privileges.</td></tr><tr style="border-width: 1px 1px 0px; border-top-style: solid; border-right-style: solid; border-bottom-style: initial; border-left-style: solid; border-top-color: rgb(238, 238, 238); border-right-color: rgb(238, 238, 238); border-bottom-color: initial; border-left-color: rgb(238, 238, 238); border-image: initial; background: rgb(238, 238, 238);"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">T1574.011</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Services Registry Permissions Weakness</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Magniber overwrites the reference registry upon execution of fodhelper.exe.</td></tr><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">T1548.002</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Bypass User Account Control</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Magniber overwrites the registry of fodhelper.exe to bypass UAC and execute the malicious VBScript with administrator privilege.</td></tr><tr style="border-width: 1px 1px 0px; border-top-style: solid; border-right-style: solid; border-bottom-style: initial; border-left-style: solid; border-top-color: rgb(238, 238, 238); border-right-color: rgb(238, 238, 238); border-bottom-color: initial; border-left-color: rgb(238, 238, 238); border-image: initial; background: rgb(238, 238, 238);"><td rowspan="2" width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Defense Evasion</td><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">T1140</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Files or Information</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">To evade detection, Magniber utilizes a technique of encoding VBScript and disguising it as a .jpg file. Once it has successfully evaded detection, Magniber then decodes the VBScript and executes it.</td></tr><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">T1497.003</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Time Based Evasion</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Magniber sleeps for random intervals to evade sandbox or antivirus detection.</td></tr><tr style="border-width: 1px 1px 0px; border-top-style: solid; border-right-style: solid; border-bottom-style: initial; border-left-style: solid; border-top-color: rgb(238, 238, 238); border-right-color: rgb(238, 238, 238); border-bottom-color: initial; border-left-color: rgb(238, 238, 238); border-image: initial; background: rgb(238, 238, 238);"><td rowspan="2" width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Impact</td><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">T1486</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Data Encrypted for Impact</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background: rgb(255, 255, 255);">Magniber encrypts the files on the computer.</td></tr><tr style="border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><td width="13%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">T1490</td><td width="22%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Inhibit System Recovery</td><td width="50%" style="padding: 1rem; border: 1px solid rgb(238, 238, 238); background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Magniber modifies the boot options.<br><br></td></tr></tbody></table></div>