{
  "family": "myransom",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variants. While it may not possess the advanced network propagation or EDR evasion techniques of apex predators like Ryuk or Conti, it is still highly effective at its core objective: encrypting the victim's data and demanding payment.<br><br><b>Understanding Myransom (Commodity Ransomware)</b><br>To an end-user, a Myransom infection results in the immediate loss of access to their personal or business files. Documents, photos, and databases are encrypted (`T1486`), their extensions are changed, and a ransom note (usually a `.txt` or `.html` file) is dropped on the desktop demanding Bitcoin. For an incident response team, this detection indicates a failure of initial defenses (phishing filters or RDP security).<br><br><b>Execution and Encryption Mechanics</b><br>Myransom variants are typically delivered via mass phishing campaigns (`T1566.001`), exploit kits, or by attackers brute-forcing exposed Remote Desktop Protocol (RDP) servers (`T1133`). Upon execution (`T1204.002`), the ransomware quickly iterates through local drives and mapped network shares (`T1083`). It utilizes standard cryptography APIs (like Microsoft CryptoAPI) to encrypt files. To ensure the victim cannot easily recover, it almost always executes a command to delete the Windows Volume Shadow Copies (`vssadmin.exe Delete Shadows /All /Quiet`) (`T1490`). It communicates with its C2 server to transmit the generated encryption key.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is significant data loss and operational downtime. Host-based IoCs include the rapid modification of files, the presence of ransom notes in every affected directory, and the execution of `vssadmin.exe` or `wbadmin.exe`. Network IoCs may include HTTP POST requests to suspicious domains transmitting the victim's machine ID and encryption keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Myransom and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Myransom is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Myransom establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Myransom typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Myransom compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Myransom should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Myransom employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Myransom typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Myransom, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Myransom depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1083",
    "T1490",
    "T1566.001",
    "T1486"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Deleting Shadow Copies)",
      "tactic": "Impact"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected endpoint from the network to prevent the ransomware from encrypting accessible network shares.",
    "Do not reboot the machine if the encryption process is still ongoing, as encryption keys might be temporarily recoverable from RAM.",
    "Identify and secure all offline backups to ensure they have not been compromised.",
    "Wipe the infected machine and restore it from a known clean image and verified backup data."
  ],
  "what_to_avoid": [
    "Do not pay the ransom; it funds criminal activity and there is no guarantee the attacker will provide a working decryption key.",
    "Avoid reconnecting the machine to the network until it has been completely wiped and re-imaged."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}