Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass

Key facts for Magniber MSI installer variant

Detection coverage for Magniber MSI installer variant

As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2481 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Magniber fodhelper.exe UAC Bypass via ms-settings Shell Open Command Hijack

Detects the registry technique used by this Magniber build to bypass UAC independent of administrator status: writing HKCU\Software\Classes\ms-settings\Shell\Open\command so that launching fodhelper.exe auto-elevates and executes Magniber's own command with high integrity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548.002, T1112, T1490, T1047, T1059.005
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| where match(lower(TargetObject), "software\\\\classes\\\\ms-settings\\\\shell\\\\open\\\\command")
| eval technique="fodhelper_uac_bypass"
| stats count min(_time) as first_seen max(_time) as last_seen values(Details) as reg_value by ComputerName, User, TargetObject
| join type=left ComputerName, User [
    search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*fodhelper.exe"
    | stats count as fodhelper_launches by ComputerName, User
]
| table ComputerName, User, TargetObject, reg_value, first_seen, last_seen, count, fodhelper_launches
| sort - last_seen

Microsoft KQL

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Software\Classes\ms-settings\Shell\Open\command"
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "fodhelper.exe"
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Fodhelper UAC Bypass via ms-settings Shell Open Command Registry Hijack (Magniber)
id: 9f2a3c10-4b7e-4b1a-9d2e-1a2b3c4d5e04
status: experimental
description: Detects the HKCU\Software\Classes\ms-settings\Shell\Open\command registry key modification used to hijack fodhelper.exe's auto-elevation behavior, as observed in the Magniber ransomware UAC-bypass stage.
references:
    - https://hshrzd.wordpress.com/2023/03/30/magniber-ransomware-analysis/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-13
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1548.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Software\Classes\ms-settings\Shell\Open\command'
    condition: selection
falsepositives:
    - Authorized red-team/pentest UAC-bypass validation using the fodhelper technique
level: high

Known false positives:

• Legitimate UAC-bypass testing by red teams/pentest tooling using the same fodhelper technique — correlate with an approved-engagement calendar before treating as malicious.

Tuning notes: Alert with highest severity when the registry write is immediately followed by a fodhelper.exe launch with no user-visible UAC prompt; correlate with subsequent EnableControlledFolderAccess=0 writes and WMI Win32_ShadowCopy queries from the same host within a short window to raise confidence.

• 🔒 Magniber Known-Hash MSI/DLL Delivery Detected via Endpoint Telemetry · unlock with TL Creds
• 🔒 Magniber Anti-Recovery Stage: VSS Deletion via WMI + Controlled Folder Access Disable · unlock with TL Creds
• 🔒 Magniber DNS Resolution of [indicator] Preceding Shellcode Injection Behavior · unlock with TL Creds
• 🔒 Suspicious Process Execution from Windows Installer Temp Cache via msiexec.exe · unlock with TL Creds
• 🔒 Self-Deleting VBScript Executed from C:\Users\Public (Magniber Anti-Recovery Stage) · unlock with TL Creds
• 🔒 Process Injection (CreateRemoteThread) Originating from Windows Installer or Temp Path · unlock with TL Creds
• 🔒 Magniber MSI CustomAction Executing Obfuscated Payload via msiexec.exe · unlock with TL Creds
• 🔒 Magniber Post-Encryption HTTP Beacon to [indicator] Ransom Gateway Domain · unlock with TL Creds

Indicators of compromise for Magniber MSI installer variant

As of 2026-09-13, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2481.

Sample indicators (3 of 16)

• Domain: jobsoon[.]fun
• File hash: 7bb15a442a5aed5b2fa47eef3bc292e9
• File hash: 796eb864005f3393c3adce70dc31d6ba

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How Magniber MSI installer variant works

This is a rewritten 2022 build of the Magniber ransomware family (first observed in 2017 targeting South Korea via the Magnitude Exploit Kit), analyzed in depth by researcher hasherezade in March 2023. The sample arrives as an MSI installer that abuses the Windows Installer CustomAction table to execute a binary ('utskzc') which calls an obfuscated exported function ('mvrtubhpxy'), loading the Magniber DLL without a directly-executable payload on disk. The binary is heavily obfuscated with extensive control-flow jump chains and malformed PE data directories that crash dynamic-tracing tools such as Pin Tracer, and it replaces standard WinAPI calls with raw NT syscalls (NtAllocateVirtualMemory, NtCreateUserProcess, NtCreateThreadEx, NtOpenProcess, NtCreateFile, NtOpenKey, NtSetValueKey, etc.) to evade userland API hooking and EDR telemetry. Independent of administrator status, the malware performs a UAC bypass by rewriting the HKCU\Software\Classes\ms-settings\Shell\Open\command registry value so that launching fodhelper.exe auto-elevates and runs Magniber's own commands with high integrity. A dropped, encrypted VBScript in C:\Users\Public\ deletes volume shadow copies via a WMI 'Win32_ShadowCopy' query, disables Windows' Controlled Folder Access protection by zeroing the EnableControlledFolderAccess registry value, drops a ransom-announcement wallpaper image, and self-deletes. File encryption uses a two-stage shellcode design: an injector stage followed by a core encryption engine that generates 16-byte AES keys (restricted to a 67-value byte set, still yielding ~1.65x10^29 possible keys) seeded from NtQueryPerformanceCounter, and encrypts eligible files with AES-128-CBC using Intel AES-NI hardware instructions (AESKEYGENASSIST/AESENC/AESENCLAST). The AES key and IV are then wrapped with a hardcoded 2048-bit RSA public key (e=0x10001); because each sample ships a single RSA keypair, all victims of that build share cryptographic exposure. Encrypted files are appended with the sample-specific extension '.vieijibfm', and a README.html ransom note is placed in every affected directory, directing victims to a Tor .onion negotiation site mirrored through victim-specific clearnet gateway URLs on the domain jobsoon.fun (e.g. http://<victim-id>vieijibfm.jobsoon.fun/). After encrypting 100 or more files, the malware beacons victim statistics (file counts, infection metrics) to a hardcoded domain over plain HTTP GET. This MSI/CustomAction/fodhelper delivery chain matches the broader 2022 evolution of Magniber documented by AhnLab ASEC, which also observed the family shift from running directly on msiexec.exe to injecting into legitimate processes around May 2022. The same operator subsequently pivoted to ZIP-archived JavaScript droppers (September 2022, using a DotNetToJScript variant) and then, from January 2023, to MSI installers with deliberately malformed Authenticode signatures that trigger a Windows SmartScreen error instead of a warning — a technique Google's Threat Analysis Group tracked as exploiting CVE-2023-24880 (a variant of the earlier CVE-2022-44698 SmartScreen/Mark-of-the-Web bypass), with over 100,000 malicious downloads observed, 80%+ concentrated in Europe. No public leak site or multi-affiliate RaaS structure has been identified for Magniber, and no specific threat actor group has been formally attributed.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.004 File Deletion; T1622 Debugger Evasion

Execution

T1047 Windows Management Instrumentation; T1059.005 Visual Basic; T1106 Native API

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

execution

T1204.002 Malicious File

stealth

T1218.007 Msiexec

Impact

T1490 Inhibit System Recovery

Privilege Escalation

T1548.002 Bypass User Account Control

Remediation for Magniber MSI installer variant

Patches

• Microsoft Patch Tuesday, March 14, 2023 — CVE-2023-24880 (Windows SmartScreen Security Feature Bypass Vulnerability).
• Microsoft Patch Tuesday, December 13, 2022 — CVE-2022-44698 (Windows SmartScreen Security Feature Bypass Vulnerability).

Immediate actions

• Set User Account Control to 'Always notify' — this specifically breaks the fodhelper.exe auto-elevation bypass used by this sample.
• Block or monitor outbound connections to jobsoon.fun and any newly-registered lookalike ransom-gateway domains.
• Ensure Controlled Folder Access is enforced via policy and alert on writes that zero its EnableControlledFolderAccess registry value.

Workarounds

• Alert on or block modification of HKCU\Software\Classes\ms-settings\Shell\Open\command.
• Alert on msiexec.exe spawning child processes or loading CustomAction DLLs from user-writable temp/download paths.

Longer-term hardening

• Apply Microsoft's March 2023 Patch Tuesday update for CVE-2023-24880 (Windows SmartScreen Security Feature Bypass) fleet-wide.
• Apply Microsoft's December 2022 patch for CVE-2022-44698 (the predecessor SmartScreen/Mark-of-the-Web bypass).
• Deploy EDR/telemetry capable of detecting direct/raw NT syscalls that bypass standard WinAPI hooking.
• Restrict execution of unsigned or freshly-downloaded MSI, APPX, and JavaScript files from non-IT-managed sources via AppLocker or WDAC.
• Maintain offline or immutable backups, since VSS shadow-copy deletion via WMI is standard behavior in this family.

Affected and fixed versions

• Microsoft — Windows 10
  Vulnerable versions: Windows 10 (build validated at runtime via KUSER_SHARED_DATA; minimum supported build required for the syscall table used)
• Microsoft — Windows SmartScreen
  Vulnerable versions: Windows 10 version 1607 and later, Windows 11, Windows Server 2016 and later — pre-March 2023 update
  Fixed in: Patched March 14, 2023 (CVE-2023-24880)

Timeline of Magniber MSI installer variant

• 2017-10-01 locked-ioc-15 ransomware first identified in the wild, distributed via the Magnitude Exploit Kit and restricted to Korean-locale (0x0412) Windows systems in South Korea.
• 2022-01-01 locked-ioc-15 distributed disguised as a digitally-signed APPX package posing as a Chrome/Edge browser update.
• 2022-04-01 locked-ioc-15 shifts to a fake Windows 10 update MSI installer that executes an obfuscated DLL via the Windows Installer CustomAction table and adds a fodhelper.exe UAC-bypass step — the rewritten variant analyzed in this threat.
• 2022-05-01 locked-ioc-15's execution model changes from running directly on msiexec.exe to injecting its ransomware payload into legitimate running processes, per AhnLab ASEC.
• 2022-09-01 locked-ioc-15 operators pivot to ZIP-archived JavaScript droppers masquerading as antivirus/Windows updates, using a DotNetToJScript variant to load a .NET payload entirely in memory.
• 2022-12-13 Microsoft patches CVE-2022-44698, the Windows SmartScreen/Mark-of-the-Web bypass locked-ioc-15 actors had been exploiting via the JScript campaign since September 2022.
• 2023-01-01 locked-ioc-15 actors begin a new MSI-based campaign abusing malformed Authenticode signatures (later designated CVE-2023-24880) to trigger a SmartScreen error instead of a warning; Google TAG later measures over 100,000 downloads, roughly 80% concentrated in Europe.
• 2023-03-14 Microsoft patches CVE-2023-24880 on Patch Tuesday; Google's Threat Analysis Group publishes technical detail on the locked-ioc-15 MSI signature-corruption bypass the same day.
• 2023-03-30 Researcher hasherezade (hshrzd) publishes a deep technical analysis of a rewritten 2022 locked-ioc-15 sample — the source for this threat — detailing raw syscalls, the fodhelper UAC bypass, AES-NI/RSA encryption, and the locked-ioc-14 extension.

Sources cited for Magniber MSI installer variant

• CVE-2023-24880 CVE Record CVE Program · Government advisory · 2023-03-14
• Magniber ransomware actors used a variant of Microsoft SmartScreen bypass Google · Research · 2023-03-14
• Magniber Ransomware Targets Users with Fake Software Updates threatresearch.ext.hp.com · Vendor report · 2023-03-16
• Ransomware Spotlight: Magniber Trend Micro · Vendor report · 2023-01-26
• Magnitude Exploit Kit Now Targeting Korea With Magniber Ransomware Trend Micro · Research · 2017-10-01
• Magniber ransomware analysis: Tiny Tracer in action hshrzd.wordpress.com · Blog · 2023-03-30
• Change in Injection Method of Magniber Ransomware asec.ahnlab.com · Blog · 2024-07-29
• Magniber ransomware now infects Windows users via JavaScript files BleepingComputer · News · 2022-10-13

More in ransomware

• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services

Previous and next in ransomware

• Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses Previous report
• Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation Next report