Resubmissions
15/06/2026, 16:20
260615-ttbf8sfv8m1015/06/2026, 16:20
260615-ts4rdscy6s1015/06/2026, 16:19
260615-tsq6asfv7n1015/06/2026, 16:18
260615-tr1y4scy411030/10/2019, 18:36
191030-74m7ldmwsn1029/10/2019, 13:10
191029-64114c38xs1029/10/2019, 10:11
191029-6b3w5klcns10Analysis
- max time kernel
132s - max time network
150s - resource
win10v191014
Task
task1
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win7v191014
0 signatures
General
- Target e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
- Sample191029-64114c38xs
- SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
Score
N/A
Malware Config
Extracted
Path
-
\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___A092GY_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2 2. http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2 3. http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2 4. http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2 5. http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2
Extracted
Path
-
\??\c:\users\admin\documents\_R_E_A_D___T_H_I_S___ZQPCE_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2 2. http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2 3. http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2 4. http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2 5. http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2
Extracted
Path
-
\??\c:\users\admin\desktop\_R_E_A_D___T_H_I_S___Z2CEYL_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2 2. http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2 3. http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2 4. http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2 5. http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2
-
http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2
Signatures
- Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 4960 netsh.exe 5056 netsh.exe - Drops file in system dir 64 IoCs
description ioc pid Process File opened for modification \??\c:\program files\ 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\ 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\ 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Cerber core protection mutex and taskkill behavior 1 IoCs
pid Process 4632 taskkill.exe - Kills process with taskkill 1 IoCs
pid Process 4632 taskkill.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4960 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 73 PID 4924 wrote to memory of 5056 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 75 PID 1616 wrote to memory of 1012 1616 SppExtComObj.exe 79 PID 4924 wrote to memory of 4520 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 81 PID 4924 wrote to memory of 4536 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 82 PID 4924 wrote to memory of 3700 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 83 PID 3700 wrote to memory of 4632 3700 cmd.exe 85 PID 3700 wrote to memory of 4756 3700 cmd.exe 87 - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeCreatePagefilePrivilege 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeDebugPrivilege 4632 taskkill.exe - Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 3352 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 3352 svchost.exe -
description ioc pid Process File opened for modification \??\c:\users\admin\documents\adddismount.pptm 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\approvemeasure.docm 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\are.docx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\closelock.potx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\disconnectcompare.xltm 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\files.docx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\installremove.xps 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\newunprotect.xltm 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\opened.docx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\outconvert.docm 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\receiveenable.pot 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\recently.docx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\submitdebug.ppt 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\these.docx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\unblockjoin.pub 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\writedismount.xlsx 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD83F.bmp" 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Windows firewall usage 2 IoCs
pid Process 4960 netsh.exe 5056 netsh.exe - Drops startup file 1 IoCs
description ioc pid Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 4924 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4536 NOTEPAD.EXE -
pid Process 4756 PING.EXE -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 5092 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 5092 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Drops file in system dir
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops Office document
- Sets desktop wallpaper using registry
- Drops startup file
PID:4924
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:4960
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:5056
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1616
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:1012
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___0273N8_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:4520
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___Z2CEYL_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4536
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3700
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Cerber core protection mutex and taskkill behavior
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.11⤵
- Runs ping.exe
PID:4756
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:3812
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:2992
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:3352
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:5092
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:3520
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1031
- T1089