Resubmissions

07-05-2020 12:10

200507-hchkfll3f2 10

04-02-2020 16:50

200204-akqmaz2wqx 10

Analysis

  • max time kernel
    115s
  • max time network
    149s
  • resource
    win10v191014
  • submitted
    04-02-2020 16:50

General

  • Target

    report.exe

  • Sample

    200204-akqmaz2wqx

  • SHA256

    9821a9264d6d80673739f0a02ad46176f2eeab5e0fedddbafa5047ac10b21a94

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies service 2 TTPs 5 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery

  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Blacklisted process makes network request 5 IoCs
  • Modifies registry class 1 IoCs
  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Runs ping.exe 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\report.exe
    "C:\Users\Admin\AppData\Local\Temp\report.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Sets desktop wallpaper using registry
    • Suspicious use of AdjustPrivilegeToken
    • Modifies registry class
    PID:5088
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:4576
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3760
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Blacklisted process makes network request
        PID:3584
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
          PID:520
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im "report.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:752
          • C:\Windows\system32\PING.EXE
            ping -n 1 127.0.0.1
            3⤵
            • Runs ping.exe
            PID:940
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Modifies service
        • Suspicious use of AdjustPrivilegeToken
        PID:4680

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads