Resubmissions
15/06/2026, 16:20
260615-ttbf8sfv8m1015/06/2026, 16:20
260615-ts4rdscy6s1015/06/2026, 16:19
260615-tsq6asfv7n1015/06/2026, 16:18
260615-tr1y4scy411030/10/2019, 18:36
191030-74m7ldmwsn1029/10/2019, 13:10
191029-64114c38xs1029/10/2019, 10:11
191029-6b3w5klcns10Analysis
- max time kernel
113s - max time network
149s - resource
win7v191014
Task
task1
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win7v191014
0 signatures
General
- Target e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
- Sample191030-74m7ldmwsn
- SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
Score
N/A
Malware Config
Extracted
Path
-
\??\c:\users\admin\documents\_R_E_A_D___T_H_I_S___FLDL9_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/A630-0910-E3A4-0446-9808 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/A630-0910-E3A4-0446-9808 2. http://p27dokhpz2n7nvgr.14ewqv.top/A630-0910-E3A4-0446-9808 3. http://p27dokhpz2n7nvgr.14vvrc.top/A630-0910-E3A4-0446-9808 4. http://p27dokhpz2n7nvgr.129p1t.top/A630-0910-E3A4-0446-9808 5. http://p27dokhpz2n7nvgr.1apgrn.top/A630-0910-E3A4-0446-9808 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/A630-0910-E3A4-0446-9808
-
http://p27dokhpz2n7nvgr.12hygy.top/A630-0910-E3A4-0446-9808
-
http://p27dokhpz2n7nvgr.14ewqv.top/A630-0910-E3A4-0446-9808
-
http://p27dokhpz2n7nvgr.14vvrc.top/A630-0910-E3A4-0446-9808
-
http://p27dokhpz2n7nvgr.129p1t.top/A630-0910-E3A4-0446-9808
-
http://p27dokhpz2n7nvgr.1apgrn.top/A630-0910-E3A4-0446-9808
Signatures
-
pid Process 480 PING.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Windows firewall usage 2 IoCs
pid Process 1640 netsh.exe 1952 netsh.exe - Drops file in system dir 64 IoCs
description ioc pid Process File opened for modification \??\c:\program files\ 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\ 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\ 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1520 conhost.exe - Cerber core protection mutex and taskkill behavior 1 IoCs
pid Process 1984 taskkill.exe -
description ioc pid Process File opened for modification \??\c:\users\admin\documents\are.docx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\convertsubmit.xls 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\exportpush.dotx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\files.docx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\limitread.ppt 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\opened.docx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\poprevoke.potx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\recently.docx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\splitassert.xls 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\these.docx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\unblockunprotect.xlsx 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\uninstallclear.ppsm 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\waitselect.dotm 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp7F2D.bmp" 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1368 NOTEPAD.EXE -
description ioc pid Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200310000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 1372 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c995300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 1372 mshta.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1640 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 27 PID 1464 wrote to memory of 1952 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 29 PID 1464 wrote to memory of 1372 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 31 PID 1464 wrote to memory of 1368 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 32 PID 1464 wrote to memory of 1936 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 34 PID 1936 wrote to memory of 1984 1936 cmd.exe 36 PID 1936 wrote to memory of 480 1936 cmd.exe 38 - Drops startup file 1 IoCs
description ioc pid Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Kills process with taskkill 1 IoCs
pid Process 1984 taskkill.exe - Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 1640 netsh.exe 1952 netsh.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1464 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeDebugPrivilege 1984 taskkill.exe - Deletes itself 1 IoCs
pid Process 1936 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Suspicious use of UnmapMainImage
- Drops file in system dir
- Drops Office document
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:1640
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2597591398348209951629390757-20837680671281542962-272171816-1368649592-2099165143"1⤵PID:1116
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset1⤵
- Windows firewall usage
- Modifies Windows Firewall
PID:1952
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-324640518-17156735511225435546-145459185-1415332762-26788766765261292-1502958317"1⤵PID:1808
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___KZWI79_.hta"1⤵
- Modifies system certificate store
PID:1372
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___PMP4R_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1368
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1936
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "438754369-87721954901231718-1796785687-2183704452061901464-7359151011660187421"1⤵
- Suspicious use of SetWindowsHookEx
PID:1520
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Cerber core protection mutex and taskkill behavior
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.11⤵
- Runs ping.exe
PID:480
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1130
- T1031