Resubmissions
15/06/2026, 16:20
260615-ttbf8sfv8m1015/06/2026, 16:20
260615-ts4rdscy6s1015/06/2026, 16:19
260615-tsq6asfv7n1015/06/2026, 16:18
260615-tr1y4scy411030/10/2019, 18:36
191030-74m7ldmwsn1029/10/2019, 13:10
191029-64114c38xs1029/10/2019, 10:11
191029-6b3w5klcns10Analysis
- max time kernel
133s - max time network
150s - resource
win10v191014
Task
task1
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win7v191014
0 signatures
General
- Target e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
- Sample191030-74m7ldmwsn
- SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
Score
N/A
Malware Config
Extracted
Path
-
\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___G7H1IS_.txt
-
cerber
Ransom Note
- CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/3C50-CE8C-AA7E-0446-992E Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/3C50-CE8C-AA7E-0446-992E 2. http://p27dokhpz2n7nvgr.14ewqv.top/3C50-CE8C-AA7E-0446-992E 3. http://p27dokhpz2n7nvgr.14vvrc.top/3C50-CE8C-AA7E-0446-992E 4. http://p27dokhpz2n7nvgr.129p1t.top/3C50-CE8C-AA7E-0446-992E 5. http://p27dokhpz2n7nvgr.1apgrn.top/3C50-CE8C-AA7E-0446-992E ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs
-
http://p27dokhpz2n7nvgr.onion/3C50-CE8C-AA7E-0446-992E
-
http://p27dokhpz2n7nvgr.12hygy.top/3C50-CE8C-AA7E-0446-992E
-
http://p27dokhpz2n7nvgr.14ewqv.top/3C50-CE8C-AA7E-0446-992E
-
http://p27dokhpz2n7nvgr.14vvrc.top/3C50-CE8C-AA7E-0446-992E
-
http://p27dokhpz2n7nvgr.129p1t.top/3C50-CE8C-AA7E-0446-992E
-
http://p27dokhpz2n7nvgr.1apgrn.top/3C50-CE8C-AA7E-0446-992E
Signatures
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc pid Process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE07C.bmp" 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 3532 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 3532 svchost.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeCreatePagefilePrivilege 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe Token: SeDebugPrivilege 4252 taskkill.exe -
description ioc pid Process File opened for modification \??\c:\users\admin\documents\adddismount.pptm 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\approvemeasure.docm 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\are.docx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\closelock.potx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\disconnectcompare.xltm 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\files.docx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\installremove.xps 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\newunprotect.xltm 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\opened.docx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\outconvert.docm 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\receiveenable.pot 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\recently.docx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\submitdebug.ppt 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\these.docx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\unblockjoin.pub 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\users\admin\documents\writedismount.xlsx 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Cerber core protection mutex and taskkill behavior 1 IoCs
pid Process 4252 taskkill.exe -
pid Process 4132 PING.EXE - Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 4852 netsh.exe 4948 netsh.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1544 NOTEPAD.EXE - Kills process with taskkill 1 IoCs
pid Process 4252 taskkill.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 3804 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 3804 svchost.exe - Windows firewall usage 2 IoCs
pid Process 4852 netsh.exe 4948 netsh.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4852 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 73 PID 4808 wrote to memory of 4948 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 75 PID 3192 wrote to memory of 4024 3192 SppExtComObj.exe 82 PID 4808 wrote to memory of 4516 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 85 PID 4808 wrote to memory of 1544 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 86 PID 4808 wrote to memory of 4540 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe 87 PID 4540 wrote to memory of 4252 4540 cmd.exe 89 PID 4540 wrote to memory of 4132 4540 cmd.exe 90 - Drops file in system dir 64 IoCs
description ioc pid Process File opened for modification \??\c:\program files\ 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\ 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\ 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe - Drops startup file 1 IoCs
description ioc pid Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ 4808 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"C:\Users\Admin\AppData\Local\Temp\e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Drops Office document
- Suspicious use of WriteProcessMemory
- Drops file in system dir
- Drops startup file
PID:4808
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:4852
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset1⤵
- Modifies Windows Firewall
- Windows firewall usage
PID:4948
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s lfsvc1⤵PID:5096
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3192
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:4024
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___PB95Z_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵PID:4516
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___I8C86_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1544
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4540
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Cerber core protection mutex and taskkill behavior
- Kills process with taskkill
PID:4252
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.11⤵
- Runs ping.exe
PID:4132
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵PID:2392
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4696
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:3532
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:3132
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:3804
Network
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Additional techniques
- T1031
- T1089