Resubmissions
15/06/2026, 16:20
260615-ttbf8sfv8m1015/06/2026, 16:20
260615-ts4rdscy6s1015/06/2026, 16:19
260615-tsq6asfv7n1015/06/2026, 16:18
260615-tr1y4scy411030/10/2019, 18:36
191030-74m7ldmwsn1029/10/2019, 13:10
191029-64114c38xs1029/10/2019, 10:11
191029-6b3w5klcns10Analysis
- max time kernel
132s - max time network
148s - resource
win10v191014
Task
task1
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win10v191014
0 signatures
General
- Target e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
- Sample191029-6b3w5klcns
- SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
Score
N/A
Malware Config
Extracted
Path
-
\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___5GQE_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472 2. http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472 3. http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472 4. http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472 5. http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472
Extracted
Path
-
\??\c:\users\admin\documents\_R_E_A_D___T_H_I_S___6UT5_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472 2. http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472 3. http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472 4. http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472 5. http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472
Extracted
Path
-
\??\c:\users\admin\desktop\_R_E_A_D___T_H_I_S___YDVD_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472 2. http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472 3. http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472 4. http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472 5. http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.12hygy.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14ewqv.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.14vvrc.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.129p1t.top/59F7-DFAA-5137-0446-9472
-
http://p27dokhpz2n7nvgr.1apgrn.top/59F7-DFAA-5137-0446-9472
Signatures
- Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 5020 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 5020 svchost.exe - cerber family
- Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4984 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 73 PID 4944 wrote to memory of 5092 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 75 PID 68 wrote to memory of 1096 68 SppExtComObj.exe 79 PID 4944 wrote to memory of 4016 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 81 PID 4944 wrote to memory of 4020 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 82 PID 4944 wrote to memory of 3704 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 83 PID 3704 wrote to memory of 4656 3704 cmd.exe 85 PID 3704 wrote to memory of 4680 3704 cmd.exe 87 - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4020 NOTEPAD.EXE - Kills process with taskkill 1 IoCs
pid Process 4656 taskkill.exe - Modifies service 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\PerfMMFileName = "Global\\MMF_BITS208c1382-8131-4594-8267-8f40e9fe9de0" 4192 svchost.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 4460 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 4460 svchost.exe - Drops startup file 1 IoCs
description ioc pid Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Windows firewall usage 2 IoCs
pid Process 4984 netsh.exe 5092 netsh.exe - Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 4984 netsh.exe 5092 netsh.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeCreatePagefilePrivilege 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeDebugPrivilege 4656 taskkill.exe - Cerber Core Protection Mutex 1 IoCs
pid Process 4656 taskkill.exe -
pid Process 4680 PING.EXE - Drops file in system dir 64 IoCs
description ioc pid Process File opened for modification \??\c:\program files\ 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\ 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\ 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe -
description ioc pid Process File opened for modification \??\c:\users\admin\documents\adddismount.pptm 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\approvemeasure.docm 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\are.docx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\closelock.potx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\disconnectcompare.xltm 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\files.docx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\installremove.xps 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\newunprotect.xltm 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\opened.docx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\outconvert.docm 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\receiveenable.pot 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\recently.docx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\these.docx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\submitdebug.ppt 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\unblockjoin.pub 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\writedismount.xlsx 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDC94.bmp" 4944 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Drops file in system dir
- Drops Office document
- Sets desktop wallpaper using registry
PID:4944
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:4984
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:5092
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:68
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:1096
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___7601R_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:4016
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YDVD_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4020
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
- Cerber Core Protection Mutex
PID:4656
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.11⤵
- Runs ping.exe
PID:4680
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Modifies service
PID:4192
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4196
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:5020
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:1756
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:4460
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1031
- T1089