cerber | 29375a5dca90281d1c512e06790ff42084bfa157fdc5f6ddbc52feb07426c517

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/03/2023, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Size

207KB
MD5

a57745a30d63f511d28aa43e4b710e1c
SHA1

5985e7d1831784fd15de2cc62451deb16b65b046
SHA256

8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3
SHA512

d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076
SSDEEP

6144:634cRT8CJLtVXW+BPGaDEoi/Siazel15:s4OT8CJpVm+BuaDm/Sps

Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer

Malware Config

Signatures

Cerber 2 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	Process
Mutant opened	shell.{F79D731C-3E7B-E57D-A314-9DE3D8E44071}	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Mutant created	shell.{F79D731C-3E7B-E57D-A314-9DE3D8E44071}	msdt.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	msdt.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1660	bcdedit.exe
268	bcdedit.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	msdt.exe

Contacts a large (514) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Deletes itself 1 IoCs

pid	Process
1072	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\msdt.lnk	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe

Executes dropped EXE 1 IoCs

pid	Process
1408	msdt.exe

Loads dropped DLL 3 IoCs

pid	Process
1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
1408	msdt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdt = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\msdt = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run	msdt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdt = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	msdt.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	msdt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\msdt = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	msdt.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1916	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
936	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Key created	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop	msdt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\\msdt.exe\""	msdt.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1568	PING.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
Token: SeDebugPrivilege	1408	msdt.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeBackupPrivilege	2036	vssvc.exe
Token: SeRestorePrivilege	2036	vssvc.exe
Token: SeAuditPrivilege	2036	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1696	wmic.exe
Token: SeSecurityPrivilege	1696	wmic.exe
Token: SeTakeOwnershipPrivilege	1696	wmic.exe
Token: SeLoadDriverPrivilege	1696	wmic.exe
Token: SeSystemProfilePrivilege	1696	wmic.exe
Token: SeSystemtimePrivilege	1696	wmic.exe
Token: SeProfSingleProcessPrivilege	1696	wmic.exe
Token: SeIncBasePriorityPrivilege	1696	wmic.exe
Token: SeCreatePagefilePrivilege	1696	wmic.exe
Token: SeBackupPrivilege	1696	wmic.exe
Token: SeRestorePrivilege	1696	wmic.exe
Token: SeShutdownPrivilege	1696	wmic.exe
Token: SeDebugPrivilege	1696	wmic.exe
Token: SeSystemEnvironmentPrivilege	1696	wmic.exe
Token: SeRemoteShutdownPrivilege	1696	wmic.exe
Token: SeUndockPrivilege	1696	wmic.exe
Token: SeManageVolumePrivilege	1696	wmic.exe
Token: 33	1696	wmic.exe
Token: 34	1696	wmic.exe
Token: 35	1696	wmic.exe
Token: SeIncreaseQuotaPrivilege	1696	wmic.exe
Token: SeSecurityPrivilege	1696	wmic.exe
Token: SeTakeOwnershipPrivilege	1696	wmic.exe
Token: SeLoadDriverPrivilege	1696	wmic.exe
Token: SeSystemProfilePrivilege	1696	wmic.exe
Token: SeSystemtimePrivilege	1696	wmic.exe
Token: SeProfSingleProcessPrivilege	1696	wmic.exe
Token: SeIncBasePriorityPrivilege	1696	wmic.exe
Token: SeCreatePagefilePrivilege	1696	wmic.exe
Token: SeBackupPrivilege	1696	wmic.exe
Token: SeRestorePrivilege	1696	wmic.exe
Token: SeShutdownPrivilege	1696	wmic.exe
Token: SeDebugPrivilege	1696	wmic.exe
Token: SeSystemEnvironmentPrivilege	1696	wmic.exe
Token: SeRemoteShutdownPrivilege	1696	wmic.exe
Token: SeUndockPrivilege	1696	wmic.exe
Token: SeManageVolumePrivilege	1696	wmic.exe
Token: 33	1696	wmic.exe
Token: 34	1696	wmic.exe
Token: 35	1696	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1408	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	28
PID 1480 wrote to memory of 1408	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	28
PID 1480 wrote to memory of 1408	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	28
PID 1480 wrote to memory of 1408	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	28
PID 1480 wrote to memory of 1072	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	29
PID 1480 wrote to memory of 1072	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	29
PID 1480 wrote to memory of 1072	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	29
PID 1480 wrote to memory of 1072	1480	8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe	29
PID 1072 wrote to memory of 936	1072	cmd.exe	31
PID 1072 wrote to memory of 936	1072	cmd.exe	31
PID 1072 wrote to memory of 936	1072	cmd.exe	31
PID 1072 wrote to memory of 936	1072	cmd.exe	31
PID 1408 wrote to memory of 1916	1408	msdt.exe	32
PID 1408 wrote to memory of 1916	1408	msdt.exe	32
PID 1408 wrote to memory of 1916	1408	msdt.exe	32
PID 1408 wrote to memory of 1916	1408	msdt.exe	32
PID 1072 wrote to memory of 1568	1072	cmd.exe	36
PID 1072 wrote to memory of 1568	1072	cmd.exe	36
PID 1072 wrote to memory of 1568	1072	cmd.exe	36
PID 1072 wrote to memory of 1568	1072	cmd.exe	36
PID 1408 wrote to memory of 1696	1408	msdt.exe	39
PID 1408 wrote to memory of 1696	1408	msdt.exe	39
PID 1408 wrote to memory of 1696	1408	msdt.exe	39
PID 1408 wrote to memory of 1696	1408	msdt.exe	39
PID 1408 wrote to memory of 1660	1408	msdt.exe	41
PID 1408 wrote to memory of 1660	1408	msdt.exe	41
PID 1408 wrote to memory of 1660	1408	msdt.exe	41
PID 1408 wrote to memory of 1660	1408	msdt.exe	41
PID 1408 wrote to memory of 268	1408	msdt.exe	43
PID 1408 wrote to memory of 268	1408	msdt.exe	43
PID 1408 wrote to memory of 268	1408	msdt.exe	43
PID 1408 wrote to memory of 268	1408	msdt.exe	43

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe
"C:\Users\Admin\AppData\Local\Temp\8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe"
1⤵
- Cerber
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe
  "C:\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe"
  2⤵
  - Cerber
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1916
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1660
- - C:\Windows\System32\bcdedit.exe
    "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:268
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /f /im "8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe" > NUL
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Network Service Scanning

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EV74ZOZO\json[1].json

Filesize
305B

MD5
9503e14ea14378cadd7d034029a92f19

SHA1
7a57c0c5d074229ec0368f00ae4289ee4cb4f63e

SHA256
8e19896bf0b7b5ae91cc4adf8a16376868731b95517760f0606175bf4ad4a8da

SHA512
10c35cf7aa7b09e81ec0ea15179f4917863b194057482fd5d17cadd8975f756b4b05519e433507f717814acc16dd77a595b854ca353956bbcd416e07d77bb22d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\msdt.lnk

Filesize
1KB

MD5
fe81b3b8bbda0cb01fc1d2a973a27938

SHA1
2df517820bcb6e66351a9447cf7af28cd2af0148

SHA256
f75acf27de82000407d24e0c0b358206ae89848e98b99416c20a86b7aed57d7a

SHA512
7241bac27d9188756426080c0792ea460aac6d351ff5eb02fadace593fd735503ade2779e6f912c6dd9d6198abeb38e41d2a8b4b1efd3d5608b6d00d6ef2817d

Download Submit
C:\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit
C:\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit
C:\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit
\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit
\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit
\Users\Admin\AppData\Roaming\{69F0F26B-6DA6-7419-5953-22751FDDDBD3}\msdt.exe

Filesize
207KB

MD5
a57745a30d63f511d28aa43e4b710e1c

SHA1
5985e7d1831784fd15de2cc62451deb16b65b046

SHA256
8cc84c910910535990b7ec98b521f7bb84774a78fa488a27dacff5590a7322e3

SHA512
d7297bc3945f14b820379989b32d9476be5c3da04ae135a4c4492cdae811956c241db5edd0ba3c858d82649dbe4fd1ca40775a7272c5b00f0a1ab77a5b4ba076

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads