Analysis
-
max time kernel
126s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 19:08
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@Cerber5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Endermanch@Cerber5.exe
Resource
win10v2004-20220901-en
General
-
Target
Endermanch@Cerber5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___ISAN7_.txt
cerber
http://xpcx6erilkjced3j.onion/4866-EB89-FAE0-0098-B4D8
http://xpcx6erilkjced3j.1n5mod.top/4866-EB89-FAE0-0098-B4D8
http://xpcx6erilkjced3j.19kdeh.top/4866-EB89-FAE0-0098-B4D8
http://xpcx6erilkjced3j.1mpsnr.top/4866-EB89-FAE0-0098-B4D8
http://xpcx6erilkjced3j.18ey8e.top/4866-EB89-FAE0-0098-B4D8
http://xpcx6erilkjced3j.17gcun.top/4866-EB89-FAE0-0098-B4D8
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exeflow pid process 2181 1128 mshta.exe 2184 1128 mshta.exe 2186 1128 mshta.exe 2188 1128 mshta.exe 2190 1128 mshta.exe 2192 1128 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Endermanch@Cerber5.exedescription ioc process File opened (read-only) \??\u: Endermanch@Cerber5.exe File opened (read-only) \??\x: Endermanch@Cerber5.exe File opened (read-only) \??\j: Endermanch@Cerber5.exe File opened (read-only) \??\k: Endermanch@Cerber5.exe File opened (read-only) \??\o: Endermanch@Cerber5.exe File opened (read-only) \??\p: Endermanch@Cerber5.exe File opened (read-only) \??\v: Endermanch@Cerber5.exe File opened (read-only) \??\w: Endermanch@Cerber5.exe File opened (read-only) \??\b: Endermanch@Cerber5.exe File opened (read-only) \??\f: Endermanch@Cerber5.exe File opened (read-only) \??\n: Endermanch@Cerber5.exe File opened (read-only) \??\r: Endermanch@Cerber5.exe File opened (read-only) \??\l: Endermanch@Cerber5.exe File opened (read-only) \??\q: Endermanch@Cerber5.exe File opened (read-only) \??\t: Endermanch@Cerber5.exe File opened (read-only) \??\y: Endermanch@Cerber5.exe File opened (read-only) \??\a: Endermanch@Cerber5.exe File opened (read-only) \??\g: Endermanch@Cerber5.exe File opened (read-only) \??\h: Endermanch@Cerber5.exe File opened (read-only) \??\i: Endermanch@Cerber5.exe File opened (read-only) \??\e: Endermanch@Cerber5.exe File opened (read-only) \??\m: Endermanch@Cerber5.exe File opened (read-only) \??\s: Endermanch@Cerber5.exe File opened (read-only) \??\z: Endermanch@Cerber5.exe -
Drops file in System32 directory 38 IoCs
Processes:
Endermanch@Cerber5.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam Endermanch@Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird Endermanch@Cerber5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
Endermanch@Cerber5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9C7F.bmp" Endermanch@Cerber5.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Endermanch@Cerber5.exedescription ioc process File opened for modification \??\c:\program files (x86)\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\steam Endermanch@Cerber5.exe File opened for modification \??\c:\program files\ Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\excel Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\office Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\word Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\ Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\program files (x86)\thunderbird Endermanch@Cerber5.exe -
Drops file in Windows directory 64 IoCs
Processes:
Endermanch@Cerber5.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook Endermanch@Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam Endermanch@Cerber5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1960 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1520 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Endermanch@Cerber5.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 1488 Endermanch@Cerber5.exe Token: SeDebugPrivilege 1960 taskkill.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Endermanch@Cerber5.exepid process 1488 Endermanch@Cerber5.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Endermanch@Cerber5.execmd.exedescription pid process target process PID 1488 wrote to memory of 1692 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1692 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1692 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1692 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1688 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1688 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1688 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1688 1488 Endermanch@Cerber5.exe netsh.exe PID 1488 wrote to memory of 1128 1488 Endermanch@Cerber5.exe mshta.exe PID 1488 wrote to memory of 1128 1488 Endermanch@Cerber5.exe mshta.exe PID 1488 wrote to memory of 1128 1488 Endermanch@Cerber5.exe mshta.exe PID 1488 wrote to memory of 1128 1488 Endermanch@Cerber5.exe mshta.exe PID 1488 wrote to memory of 1520 1488 Endermanch@Cerber5.exe NOTEPAD.EXE PID 1488 wrote to memory of 1520 1488 Endermanch@Cerber5.exe NOTEPAD.EXE PID 1488 wrote to memory of 1520 1488 Endermanch@Cerber5.exe NOTEPAD.EXE PID 1488 wrote to memory of 1520 1488 Endermanch@Cerber5.exe NOTEPAD.EXE PID 1488 wrote to memory of 1376 1488 Endermanch@Cerber5.exe cmd.exe PID 1488 wrote to memory of 1376 1488 Endermanch@Cerber5.exe cmd.exe PID 1488 wrote to memory of 1376 1488 Endermanch@Cerber5.exe cmd.exe PID 1488 wrote to memory of 1376 1488 Endermanch@Cerber5.exe cmd.exe PID 1376 wrote to memory of 1960 1376 cmd.exe taskkill.exe PID 1376 wrote to memory of 1960 1376 cmd.exe taskkill.exe PID 1376 wrote to memory of 1960 1376 cmd.exe taskkill.exe PID 1376 wrote to memory of 1960 1376 cmd.exe taskkill.exe PID 1376 wrote to memory of 2016 1376 cmd.exe PING.EXE PID 1376 wrote to memory of 2016 1376 cmd.exe PING.EXE PID 1376 wrote to memory of 2016 1376 cmd.exe PING.EXE PID 1376 wrote to memory of 2016 1376 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@Cerber5.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@Cerber5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___K3WM_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___85QC8_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "E"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___85QC8_.txtFilesize
1KB
MD5ab3dd671fb5340f43008c851451f2bb4
SHA1880400572f9316ec9d9d0abc0dd79e81ce64f326
SHA256e80bec99bbc34fdaace7365f3982ff9aab01896de1f70abde6b73de5d0aab43c
SHA512e44e72cdcbbf4a0796f116334f19f0e84db9de4b36acae461317d5161d87725685c4ed8d2879cb429df3fa4c1a6d288bb169b7cf7d48baf84bc9cc2a36e2ebd2
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___K3WM_.htaFilesize
75KB
MD55d5a79996a7101d03c046373bbdc4fdc
SHA1e606335553a6490fcc074f1933edf29a41b261c3
SHA25685aa901e09ba11eaf0265a3b2b8032d9e894e22ba4c95467545890c7e17ad47f
SHA512c256b9ce0b90bc226207aee845cf7c3eb2bcfc367760528080d8db83c5eb6508d9d070597ae057c9cbaa5c9a6ed91fb98251102b08bfef27cb5b6127f28ae423
-
memory/1128-61-0x0000000000000000-mapping.dmp
-
memory/1376-67-0x0000000000000000-mapping.dmp
-
memory/1488-60-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1488-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1488-56-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1488-55-0x00000000001F0000-0x0000000000221000-memory.dmpFilesize
196KB
-
memory/1488-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1520-62-0x0000000000000000-mapping.dmp
-
memory/1688-58-0x0000000000000000-mapping.dmp
-
memory/1692-57-0x0000000000000000-mapping.dmp
-
memory/1960-69-0x0000000000000000-mapping.dmp
-
memory/2016-70-0x0000000000000000-mapping.dmp