Resubmissions

07-05-2020 12:10

200507-hchkfll3f2 10

04-02-2020 16:50

200204-akqmaz2wqx 10

Analysis

  • max time kernel
    132s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    07-05-2020 12:10

General

  • Target

    report.exe

  • Size

    359KB

  • MD5

    2b6e4fef6c9a6a11b8d841bcf8c3b378

  • SHA1

    14c13bc7d0ec2f9d71e235493bf3857b792628c0

  • SHA256

    9821a9264d6d80673739f0a02ad46176f2eeab5e0fedddbafa5047ac10b21a94

  • SHA512

    1faa40aa84ba1f5b64d67a292c85da562ae16fc464c1b29883593eb4f7c98f8abe42a300e169747b3aba524708d9e686b711ea1fc1748bb970136d24902bb178

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Modifies registry class 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Blacklisted process makes network request 5 IoCs
  • Makes http(s) request 5 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies service 2 TTPs 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 366 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\report.exe
    "C:\Users\Admin\AppData\Local\Temp\report.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Modifies registry class
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    PID:2916
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:556
        • C:\Windows\system32\wbem\WMIC.exe
          C:\Windows\system32\wbem\wmic.exe shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:904
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
        • Blacklisted process makes network request
        • Suspicious use of SetWindowsHookEx
        PID:800
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
          PID:3796
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im "report.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            • Kills process with taskkill
            PID:4044
          • C:\Windows\system32\PING.EXE
            ping -n 1 127.0.0.1
            3⤵
            • Runs ping.exe
            PID:1880
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Modifies service
        PID:1140

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads