Resubmissions

07-05-2020 12:10

200507-hchkfll3f2 10

04-02-2020 16:50

200204-akqmaz2wqx 10

Analysis

  • max time kernel
    113s
  • max time network
    121s
  • resource
    win7v191014
  • submitted
    04-02-2020 16:50

General

  • Target

    report.exe

  • Sample

    200204-akqmaz2wqx

  • SHA256

    9821a9264d6d80673739f0a02ad46176f2eeab5e0fedddbafa5047ac10b21a94

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Modifies service 2 TTPs 5 IoCs
  • Deletes itself 1 IoCs
  • Blacklisted process makes network request 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\report.exe
    "C:\Users\Admin\AppData\Local\Temp\report.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Drops file in Program Files directory
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious behavior: EnumeratesProcesses
    PID:1428
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:1400
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1108
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta"
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Blacklisted process makes network request
        • Modifies Internet Explorer settings
        PID:1708
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Deletes itself
        PID:972
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "report.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Kills process with taskkill
          PID:1136
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1924
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Modifies service
      PID:1156
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
      1⤵
        PID:320

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads