Analysis
-
max time kernel
139s -
max time network
155s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
18-06-2020 23:20
Static task
static1
Behavioral task
behavioral1
Sample
cfd2d6f189b04d42618007fc9c540352.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
cfd2d6f189b04d42618007fc9c540352.exe
Resource
win10
General
-
Target
cfd2d6f189b04d42618007fc9c540352.exe
-
Size
252KB
-
MD5
cfd2d6f189b04d42618007fc9c540352
-
SHA1
f8413a21c4179378b2c23a3302ba33505e273430
-
SHA256
408fd7edadfbdaab161e04afcfc115c464916e99aaba8b036f52c57c3ade49c5
-
SHA512
5a1917dd23aa02e273ba0fc381961ed7fab4dc70202f62a581b6361c4d34b7ce51b3f3adf61d9dec8ab49b4667573f7755f2a968a836d10d1afbadab598a6cc0
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___B1QQT_.txt
cerber
http://xpcx6erilkjced3j.onion/6060-6F07-2EC7-0446-AF7A
http://xpcx6erilkjced3j.18ey8e.top/6060-6F07-2EC7-0446-AF7A
http://xpcx6erilkjced3j.17gcun.top/6060-6F07-2EC7-0446-AF7A
http://xpcx6erilkjced3j.1ebjjq.top/6060-6F07-2EC7-0446-AF7A
http://xpcx6erilkjced3j.15ezkm.top/6060-6F07-2EC7-0446-AF7A
http://xpcx6erilkjced3j.1mfmkz.top/6060-6F07-2EC7-0446-AF7A
Signatures
-
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1252 1492 cfd2d6f189b04d42618007fc9c540352.exe 26 PID 1492 wrote to memory of 1252 1492 cfd2d6f189b04d42618007fc9c540352.exe 26 PID 1492 wrote to memory of 1252 1492 cfd2d6f189b04d42618007fc9c540352.exe 26 PID 1492 wrote to memory of 1252 1492 cfd2d6f189b04d42618007fc9c540352.exe 26 PID 1492 wrote to memory of 1848 1492 cfd2d6f189b04d42618007fc9c540352.exe 28 PID 1492 wrote to memory of 1848 1492 cfd2d6f189b04d42618007fc9c540352.exe 28 PID 1492 wrote to memory of 1848 1492 cfd2d6f189b04d42618007fc9c540352.exe 28 PID 1492 wrote to memory of 1848 1492 cfd2d6f189b04d42618007fc9c540352.exe 28 PID 1492 wrote to memory of 1384 1492 cfd2d6f189b04d42618007fc9c540352.exe 31 PID 1492 wrote to memory of 1384 1492 cfd2d6f189b04d42618007fc9c540352.exe 31 PID 1492 wrote to memory of 1384 1492 cfd2d6f189b04d42618007fc9c540352.exe 31 PID 1492 wrote to memory of 1384 1492 cfd2d6f189b04d42618007fc9c540352.exe 31 PID 1492 wrote to memory of 1652 1492 cfd2d6f189b04d42618007fc9c540352.exe 32 PID 1492 wrote to memory of 1652 1492 cfd2d6f189b04d42618007fc9c540352.exe 32 PID 1492 wrote to memory of 1652 1492 cfd2d6f189b04d42618007fc9c540352.exe 32 PID 1492 wrote to memory of 1652 1492 cfd2d6f189b04d42618007fc9c540352.exe 32 PID 1492 wrote to memory of 1616 1492 cfd2d6f189b04d42618007fc9c540352.exe 33 PID 1492 wrote to memory of 1616 1492 cfd2d6f189b04d42618007fc9c540352.exe 33 PID 1492 wrote to memory of 1616 1492 cfd2d6f189b04d42618007fc9c540352.exe 33 PID 1492 wrote to memory of 1616 1492 cfd2d6f189b04d42618007fc9c540352.exe 33 PID 1616 wrote to memory of 1572 1616 cmd.exe 35 PID 1616 wrote to memory of 1572 1616 cmd.exe 35 PID 1616 wrote to memory of 1572 1616 cmd.exe 35 PID 1616 wrote to memory of 1572 1616 cmd.exe 35 PID 1616 wrote to memory of 2004 1616 cmd.exe 37 PID 1616 wrote to memory of 2004 1616 cmd.exe 37 PID 1616 wrote to memory of 2004 1616 cmd.exe 37 PID 1616 wrote to memory of 2004 1616 cmd.exe 37 -
Blacklisted process makes network request 7 IoCs
flow pid Process 2182 1384 mshta.exe 2185 1384 mshta.exe 2187 1384 mshta.exe 2189 1384 mshta.exe 2191 1384 mshta.exe 2193 1384 mshta.exe 2195 1384 mshta.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 mshta.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ cfd2d6f189b04d42618007fc9c540352.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2004 PING.EXE -
Modifies Windows Firewall 1 TTPs
-
Kills process with taskkill 1 IoCs
pid Process 1572 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1492 cfd2d6f189b04d42618007fc9c540352.exe Token: SeDebugPrivilege 1572 taskkill.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe -
Drops file in Windows directory 77 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\ cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents cfd2d6f189b04d42618007fc9c540352.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word cfd2d6f189b04d42618007fc9c540352.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin cfd2d6f189b04d42618007fc9c540352.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1652 NOTEPAD.EXE -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp61BE.bmp" cfd2d6f189b04d42618007fc9c540352.exe -
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Modifies service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe -
Enumerates connected drives 3 TTPs
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfd2d6f189b04d42618007fc9c540352.exe"C:\Users\Admin\AppData\Local\Temp\cfd2d6f189b04d42618007fc9c540352.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Drops file in Windows directory
- Drops file in System32 directory
- Sets desktop wallpaper using registry
PID:1492 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies service
PID:1252
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies service
PID:1848
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___WZKRT2SJ_.hta"2⤵
- Blacklisted process makes network request
- Modifies system certificate store
- Modifies Internet Explorer settings
PID:1384
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YRBU_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "c" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "c"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:2004
-
-