Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
cerber5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cerber5.exe
Resource
win10v2004-20231215-en
General
-
Target
cerber5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___VMRLIK_.txt
cerber
http://xpcx6erilkjced3j.onion/2F16-8A90-7970-0098-B774
http://xpcx6erilkjced3j.1n5mod.top/2F16-8A90-7970-0098-B774
http://xpcx6erilkjced3j.19kdeh.top/2F16-8A90-7970-0098-B774
http://xpcx6erilkjced3j.1mpsnr.top/2F16-8A90-7970-0098-B774
http://xpcx6erilkjced3j.18ey8e.top/2F16-8A90-7970-0098-B774
http://xpcx6erilkjced3j.17gcun.top/2F16-8A90-7970-0098-B774
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1103) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4636 netsh.exe 1188 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cerber5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation cerber5.exe -
Drops startup file 1 IoCs
Processes:
cerber5.exedescription ioc process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ cerber5.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cerber5.exedescription ioc process File opened (read-only) \??\e: cerber5.exe File opened (read-only) \??\y: cerber5.exe File opened (read-only) \??\a: cerber5.exe File opened (read-only) \??\b: cerber5.exe File opened (read-only) \??\k: cerber5.exe File opened (read-only) \??\x: cerber5.exe File opened (read-only) \??\g: cerber5.exe File opened (read-only) \??\h: cerber5.exe File opened (read-only) \??\i: cerber5.exe File opened (read-only) \??\j: cerber5.exe File opened (read-only) \??\l: cerber5.exe File opened (read-only) \??\m: cerber5.exe File opened (read-only) \??\p: cerber5.exe File opened (read-only) \??\s: cerber5.exe File opened (read-only) \??\u: cerber5.exe File opened (read-only) \??\z: cerber5.exe File opened (read-only) \??\n: cerber5.exe File opened (read-only) \??\o: cerber5.exe File opened (read-only) \??\q: cerber5.exe File opened (read-only) \??\r: cerber5.exe File opened (read-only) \??\t: cerber5.exe File opened (read-only) \??\v: cerber5.exe File opened (read-only) \??\w: cerber5.exe -
Drops file in System32 directory 38 IoCs
Processes:
cerber5.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! cerber5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
cerber5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9078.bmp" cerber5.exe -
Drops file in Program Files directory 20 IoCs
Processes:
cerber5.exedescription ioc process File opened for modification \??\c:\program files (x86)\bitcoin cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\program files (x86)\office cerber5.exe File opened for modification \??\c:\program files (x86)\the bat! cerber5.exe File opened for modification \??\c:\program files (x86)\word cerber5.exe File opened for modification \??\c:\program files (x86)\excel cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\word cerber5.exe File opened for modification \??\c:\program files (x86)\onenote cerber5.exe File opened for modification \??\c:\program files (x86)\outlook cerber5.exe File opened for modification \??\c:\program files (x86)\powerpoint cerber5.exe File opened for modification \??\c:\program files (x86)\ cerber5.exe File opened for modification \??\c:\program files (x86)\thunderbird cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\office cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote cerber5.exe File opened for modification \??\c:\program files (x86)\steam cerber5.exe File opened for modification \??\c:\program files\ cerber5.exe -
Drops file in Windows directory 64 IoCs
Processes:
cerber5.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird cerber5.exe File opened for modification \??\c:\windows\ cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel cerber5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4272 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
cerber5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings cerber5.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2292 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cerber5.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 4220 cerber5.exe Token: SeCreatePagefilePrivilege 4220 cerber5.exe Token: SeDebugPrivilege 4272 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cerber5.execmd.exedescription pid process target process PID 4220 wrote to memory of 4636 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 4636 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 4636 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 1188 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 1188 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 1188 4220 cerber5.exe netsh.exe PID 4220 wrote to memory of 3376 4220 cerber5.exe mshta.exe PID 4220 wrote to memory of 3376 4220 cerber5.exe mshta.exe PID 4220 wrote to memory of 3376 4220 cerber5.exe mshta.exe PID 4220 wrote to memory of 2292 4220 cerber5.exe NOTEPAD.EXE PID 4220 wrote to memory of 2292 4220 cerber5.exe NOTEPAD.EXE PID 4220 wrote to memory of 2292 4220 cerber5.exe NOTEPAD.EXE PID 4220 wrote to memory of 1316 4220 cerber5.exe cmd.exe PID 4220 wrote to memory of 1316 4220 cerber5.exe cmd.exe PID 4220 wrote to memory of 1316 4220 cerber5.exe cmd.exe PID 1316 wrote to memory of 4272 1316 cmd.exe taskkill.exe PID 1316 wrote to memory of 4272 1316 cmd.exe taskkill.exe PID 1316 wrote to memory of 4272 1316 cmd.exe taskkill.exe PID 1316 wrote to memory of 400 1316 cmd.exe PING.EXE PID 1316 wrote to memory of 400 1316 cmd.exe PING.EXE PID 1316 wrote to memory of 400 1316 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cerber5.exe"C:\Users\Admin\AppData\Local\Temp\cerber5.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___6YP0NRPR_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___2SKPX_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "c" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "c"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___MWIOA5FN_.htaFilesize
76KB
MD5f1b402ba5f7eec17a2df4ffbe23abe81
SHA193847fb5fdd9c3627b54c12c284ba0e8edab17c8
SHA25646635fe1a7f1b6947fb6d0a5c6e2dfad8b757c66c31434532df9e4424d7782a0
SHA5125652c3068b30e3a1e1269658e815e6f2191b4c5e00dda1f6e3d556c4f38895dd31dd4ea900c8567ca8a263371d7dc9407aa2bf342e77b1aa52d30be39d2d38eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___VMRLIK_.txtFilesize
1KB
MD5c2f81f8156797b52bd3e6bc682e9684b
SHA1203ea70dc940fb441033188ec43850678973b1c5
SHA256eeee91128e26e10e0ebac9aacfe1f6e82a5a92845797f626aec65d577a0a4d6c
SHA512b8a95dc2902b6d1e026b8eddc43169e6ea1eda0895ccbc7ae368b8d0b5859980bbc98490787e8625371d02aab8edacbb67e35f7ba147c635a9e22ae60f27ad05
-
memory/4220-0-0x0000000001520000-0x0000000001551000-memory.dmpFilesize
196KB
-
memory/4220-1-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4220-2-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4220-6-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4220-380-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4220-400-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB