5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f

General

Target

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Size

149KB
MD5

1d864d76040af03041850d855b3b4430
SHA1

136ffd632fde395f42db66d698ebd03c105ed78f
SHA256

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f
SHA512

96ea45088713a4149cfb96034637d405ad78abba6d6332b3459fecc649e2fcdcfa0bee6acfeb8cd971bec88d2c2cd80ee4e6656d95ad95542c25f2f0c9232721

Score

10^/10

discovery persistence ransomware spyware stealer suricata

Malware Config

Signatures

suricata: ET MALWARE Ransomware/Cerber Checkin 2
suricata: ET MALWARE Ransomware/Cerber Checkin 2
suricata
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (2)
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (2)
suricata
Contacts a large (16396) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exeOposHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	OposHost.exe

Executes dropped EXE 1 IoCs

Processes:

OposHost.exe

pid process

4396 OposHost.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

OposHost.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation OposHost.exe

pid	process
4396	OposHost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	OposHost.exe

Drops startup file 1 IoCs

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\OposHost.lnk	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exeOposHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OposHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OposHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run	OposHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OposHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	OposHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OposHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OposHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	OposHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows\CurrentVersion\Run	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ipinfo.io
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4336 vssadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3232 taskkill.exe

flow	ioc
8	ipinfo.io

pid	process
4336	vssadmin.exe

pid	process
3232	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exeOposHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\Desktop	OposHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\\OposHost.exe\""	OposHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\Desktop	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3164 PING.EXE

pid	process
3164	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exetaskkill.exeOposHost.exevssvc.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	4396	OposHost.exe
Token: SeBackupPrivilege	836	vssvc.exe
Token: SeRestorePrivilege	836	vssvc.exe
Token: SeAuditPrivilege	836	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4536	wmic.exe
Token: SeSecurityPrivilege	4536	wmic.exe
Token: SeTakeOwnershipPrivilege	4536	wmic.exe
Token: SeLoadDriverPrivilege	4536	wmic.exe
Token: SeSystemProfilePrivilege	4536	wmic.exe
Token: SeSystemtimePrivilege	4536	wmic.exe
Token: SeProfSingleProcessPrivilege	4536	wmic.exe
Token: SeIncBasePriorityPrivilege	4536	wmic.exe
Token: SeCreatePagefilePrivilege	4536	wmic.exe
Token: SeBackupPrivilege	4536	wmic.exe
Token: SeRestorePrivilege	4536	wmic.exe
Token: SeShutdownPrivilege	4536	wmic.exe
Token: SeDebugPrivilege	4536	wmic.exe
Token: SeSystemEnvironmentPrivilege	4536	wmic.exe
Token: SeRemoteShutdownPrivilege	4536	wmic.exe
Token: SeUndockPrivilege	4536	wmic.exe
Token: SeManageVolumePrivilege	4536	wmic.exe
Token: 33	4536	wmic.exe
Token: 34	4536	wmic.exe
Token: 35	4536	wmic.exe
Token: 36	4536	wmic.exe
Token: SeIncreaseQuotaPrivilege	4536	wmic.exe
Token: SeSecurityPrivilege	4536	wmic.exe
Token: SeTakeOwnershipPrivilege	4536	wmic.exe
Token: SeLoadDriverPrivilege	4536	wmic.exe
Token: SeSystemProfilePrivilege	4536	wmic.exe
Token: SeSystemtimePrivilege	4536	wmic.exe
Token: SeProfSingleProcessPrivilege	4536	wmic.exe
Token: SeIncBasePriorityPrivilege	4536	wmic.exe
Token: SeCreatePagefilePrivilege	4536	wmic.exe
Token: SeBackupPrivilege	4536	wmic.exe
Token: SeRestorePrivilege	4536	wmic.exe
Token: SeShutdownPrivilege	4536	wmic.exe
Token: SeDebugPrivilege	4536	wmic.exe
Token: SeSystemEnvironmentPrivilege	4536	wmic.exe
Token: SeRemoteShutdownPrivilege	4536	wmic.exe
Token: SeUndockPrivilege	4536	wmic.exe
Token: SeManageVolumePrivilege	4536	wmic.exe
Token: 33	4536	wmic.exe
Token: 34	4536	wmic.exe
Token: 35	4536	wmic.exe
Token: 36	4536	wmic.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.execmd.exeOposHost.exe

description	pid	process	target process
PID 784 wrote to memory of 4396	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	OposHost.exe
PID 784 wrote to memory of 4396	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	OposHost.exe
PID 784 wrote to memory of 4396	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	OposHost.exe
PID 784 wrote to memory of 8	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	cmd.exe
PID 784 wrote to memory of 8	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	cmd.exe
PID 784 wrote to memory of 8	784	5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe	cmd.exe
PID 8 wrote to memory of 3232	8	cmd.exe	taskkill.exe
PID 8 wrote to memory of 3232	8	cmd.exe	taskkill.exe
PID 8 wrote to memory of 3232	8	cmd.exe	taskkill.exe
PID 8 wrote to memory of 3164	8	cmd.exe	PING.EXE
PID 8 wrote to memory of 3164	8	cmd.exe	PING.EXE
PID 8 wrote to memory of 3164	8	cmd.exe	PING.EXE
PID 4396 wrote to memory of 4336	4396	OposHost.exe	vssadmin.exe
PID 4396 wrote to memory of 4336	4396	OposHost.exe	vssadmin.exe
PID 4396 wrote to memory of 4536	4396	OposHost.exe	wmic.exe
PID 4396 wrote to memory of 4536	4396	OposHost.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe
"C:\Users\Admin\AppData\Local\Temp\5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe"
1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Roaming\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\OposHost.exe
"C:\Users\Admin\AppData\Roaming\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\OposHost.exe"
2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\system32\vssadmin.exe
"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4336

C:\Windows\system32\wbem\wmic.exe
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\SysWOW64\cmd.exe
/d /c taskkill /t /f /im "5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe" > NUL
2⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\taskkill.exe
taskkill /t /f /im "5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\SysWOW64\PING.EXE
ping -n 1 127.0.0.1
3⤵
- Runs ping.exe
PID:3164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Network Service Scanning

2

T1046

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\OposHost.lnk
Filesize
1KB

MD5
ce5c2dd9a481c0bb9430831822a0dae5

SHA1
745fa85cd8c17a904bab6142eb9f3e09f90609b0

SHA256
bee4890e81c205f3e2982382a90594a094b291a185427f68d5832d7da9e701f8

SHA512
e925700a6188844490ebba8cb345b122d884305f58ad6ab46f02b9b6946b13411724961999dfc12a374c8d32ee3820c7e0dcb188f5e362062bdb608b5b9e4918

Download Submit
C:\Users\Admin\AppData\Roaming\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\OposHost.exe
Filesize
149KB

MD5
1d864d76040af03041850d855b3b4430

SHA1
136ffd632fde395f42db66d698ebd03c105ed78f

SHA256
5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f

SHA512
96ea45088713a4149cfb96034637d405ad78abba6d6332b3459fecc649e2fcdcfa0bee6acfeb8cd971bec88d2c2cd80ee4e6656d95ad95542c25f2f0c9232721

Download Submit
C:\Users\Admin\AppData\Roaming\{1EE01B27-2F7F-6A70-886C-5FE2EB4CA709}\OposHost.exe
Filesize
149KB

MD5
1d864d76040af03041850d855b3b4430

SHA1
136ffd632fde395f42db66d698ebd03c105ed78f

SHA256
5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f

SHA512
96ea45088713a4149cfb96034637d405ad78abba6d6332b3459fecc649e2fcdcfa0bee6acfeb8cd971bec88d2c2cd80ee4e6656d95ad95542c25f2f0c9232721

Download Submit
memory/8-135-0x0000000000000000-mapping.dmp

Download
memory/784-131-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/784-137-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/784-138-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/784-130-0x0000000000A70000-0x0000000000B53000-memory.dmp

Filesize
908KB

Download
memory/3164-139-0x0000000000000000-mapping.dmp

Download
memory/3232-136-0x0000000000000000-mapping.dmp

Download
memory/4336-141-0x0000000000000000-mapping.dmp

Download
memory/4396-142-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4396-140-0x00000000024D0000-0x00000000024E6000-memory.dmp

Filesize
88KB

Download
memory/4396-132-0x0000000000000000-mapping.dmp

Download
memory/4396-145-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4536-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads