Overview

overview

10

Static

static

3

Ransomware.Cerber.zip

windows7-x64

1

Ransomware.Cerber.zip

windows10-2004-x64

1

cerber.exe

windows7-x64

10

cerber.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    182s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2023 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cerber.exe

  • Size

    604KB

  • MD5

    8b6bc16fd137c09a08b02bbe1bb7d670

  • SHA1

    c69a0f6c6f809c01db92ca658fcf1b643391a2b7

  • SHA256

    e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678

  • SHA512

    b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24

  • SSDEEP

    6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01

Score
10/10
cerberdiscoveryevasionransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___4XAE2ITD_.txt

Family

cerber

Ransom Note
CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/ABD1-8056-0E9A-0446-9628 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/ABD1-8056-0E9A-0446-9628 2. http://p27dokhpz2n7nvgr.14ewqv.top/ABD1-8056-0E9A-0446-9628 3. http://p27dokhpz2n7nvgr.14vvrc.top/ABD1-8056-0E9A-0446-9628 4. http://p27dokhpz2n7nvgr.129p1t.top/ABD1-8056-0E9A-0446-9628 5. http://p27dokhpz2n7nvgr.1apgrn.top/ABD1-8056-0E9A-0446-9628 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/ABD1-8056-0E9A-0446-9628

http://p27dokhpz2n7nvgr.12hygy.top/ABD1-8056-0E9A-0446-9628

http://p27dokhpz2n7nvgr.14ewqv.top/ABD1-8056-0E9A-0446-9628

http://p27dokhpz2n7nvgr.14vvrc.top/ABD1-8056-0E9A-0446-9628

http://p27dokhpz2n7nvgr.129p1t.top/ABD1-8056-0E9A-0446-9628

http://p27dokhpz2n7nvgr.1apgrn.top/ABD1-8056-0E9A-0446-9628

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Blocklisted process makes network request 6 IoCs
  • Contacts a large (1095) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cerber.exe
    "C:\Users\Admin\AppData\Local\Temp\cerber.exe"
    1⤵
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
      2⤵
      • Modifies Windows Firewall
      PID:2200
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall reset
      2⤵
      • Modifies Windows Firewall
      PID:2760
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___3I51NG1_.hta"
      2⤵
      • Blocklisted process makes network request
      • Modifies Internet Explorer settings
      PID:300
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___4XAE2ITD_.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2564
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im "cerber.exe"
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2764
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 1 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1764
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\EditApprove.docm"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabAA55.tmp
    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarAAF4.tmp
    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    Download Submit

  • C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___3I51NG1_.hta
    Filesize

    75KB

    MD5

    5795a1d2749efe31937f3bb24bc84aff

    SHA1

    90d6c1e81215561b6a61fe21fe486fbc2173e9f0

    SHA256

    4b03f21463ecd1e38a8eee663c4a12afa21834240d896b72b5f45c2076e587e3

    SHA512

    e1fb3c5a71d5d466c557c823955eec4252adda3c1946a86877a5a2f7e20ee5255299eba6e0403341be5b25cf409c7dc6b5caf9f4bd38fb3fe3318191e7c650d9

    Download Submit

  • C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___4XAE2ITD_.txt
    Filesize

    1KB

    MD5

    c1d01e23922ddb754b3a4640686f6aca

    SHA1

    5e5d55c69da0a54ed2829479494976d328abe527

    SHA256

    e52f81f347f9326ad8366c75ab94479647f8a7ba778132808e3526899e8ea8b2

    SHA512

    789526c5c7fa19661051767aba78b66be44f34b181063287dc40d4bb2436876957966b4e0f0b42b455bc627768134f78199fedd55c29cbe83c2ddc8a468badc5

    Download Submit

  • memory/1740-42-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-5-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-16-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-17-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-23-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-37-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-1-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-76-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-9-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-10-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-104-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-105-0x0000000000440000-0x0000000000451000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1740-2-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

    Download

  • memory/1740-0-0x00000000003A0000-0x00000000003D1000-memory.dmp

    Filesize

    196KB

    Download

  • memory/1900-175-0x000000002F4F1000-0x000000002F4F2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1900-176-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1900-177-0x00000000713BD000-0x00000000713C8000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1900-180-0x00000000713BD000-0x00000000713C8000-memory.dmp

    Filesize

    44KB

    Download