Resubmissions

07-05-2020 12:10

200507-hchkfll3f2 10

04-02-2020 16:50

200204-akqmaz2wqx 10

Analysis

  • max time kernel
    135s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    07-05-2020 12:10

General

  • Target

    report.exe

  • Size

    359KB

  • MD5

    2b6e4fef6c9a6a11b8d841bcf8c3b378

  • SHA1

    14c13bc7d0ec2f9d71e235493bf3857b792628c0

  • SHA256

    9821a9264d6d80673739f0a02ad46176f2eeab5e0fedddbafa5047ac10b21a94

  • SHA512

    1faa40aa84ba1f5b64d67a292c85da562ae16fc464c1b29883593eb4f7c98f8abe42a300e169747b3aba524708d9e686b711ea1fc1748bb970136d24902bb178

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Makes http(s) request 4 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 151 IoCs
  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Blacklisted process makes network request 3 IoCs
  • Modifies service 2 TTPs 5 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Deletes itself 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\report.exe
    "C:\Users\Admin\AppData\Local\Temp\report.exe"
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Drops file in Program Files directory
    • Sets desktop wallpaper using registry
    PID:1432
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:792
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1552
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Blacklisted process makes network request
        PID:1364
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Deletes itself
        PID:1488
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "report.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Kills process with taskkill
          PID:2004
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1516
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Modifies service
      PID:1656
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
      1⤵
        PID:1308

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads