Overview
overview
10Static
static
77ev3n.exe
windows7-x64
7ev3n.exe
windows10-2004-x64
Annabelle.exe
windows7-x64
Annabelle.exe
windows10-2004-x64
BadRabbit.exe
windows7-x64
BadRabbit.exe
windows10-2004-x64
Birele.exe
windows10-2004-x64
10Cerber 5.exe
windows7-x64
10Cerber 5.exe
windows10-2004-x64
10Darkside.exe
windows7-x64
10Darkside.exe
windows10-2004-x64
10DeriaLock.exe
windows7-x64
7DeriaLock.exe
windows10-2004-x64
7Analysis
-
max time kernel
119s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 21:34
Behavioral task
behavioral1
Sample
7ev3n.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ev3n.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Annabelle.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Annabelle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
BadRabbit.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
BadRabbit.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
Birele.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cerber 5.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
Cerber 5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral10
Sample
Darkside.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
Darkside.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
DeriaLock.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
DeriaLock.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Cerber 5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___CW0SLB_.txt
Family
cerber
Ransom Note
Hi, I'am CRBR ENCRYPTOR ;)
-----
ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
-----
The only one way to decrypt your files is to receive the private key and decryption program.
To receive the private key and decryption program go to any decrypted folder,
inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions
how to decrypt your files.
If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below:
-----
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://xpcx6erilkjced3j.onion/6E20-96B6-A2B0-0098-B89E
Note! This page is available via "Tor Browser" only.
-----
Also you can use temporary addresses on your personal page without using "Tor Browser".
-----
1. http://xpcx6erilkjced3j.1n5mod.top/6E20-96B6-A2B0-0098-B89E
2. http://xpcx6erilkjced3j.19kdeh.top/6E20-96B6-A2B0-0098-B89E
3. http://xpcx6erilkjced3j.1mpsnr.top/6E20-96B6-A2B0-0098-B89E
4. http://xpcx6erilkjced3j.18ey8e.top/6E20-96B6-A2B0-0098-B89E
5. http://xpcx6erilkjced3j.17gcun.top/6E20-96B6-A2B0-0098-B89E
-----
Note! These are temporary addresses! They will be available for a limited amount of time!
-----
URLs
http://xpcx6erilkjced3j.onion/6E20-96B6-A2B0-0098-B89E
http://xpcx6erilkjced3j.1n5mod.top/6E20-96B6-A2B0-0098-B89E
http://xpcx6erilkjced3j.19kdeh.top/6E20-96B6-A2B0-0098-B89E
http://xpcx6erilkjced3j.1mpsnr.top/6E20-96B6-A2B0-0098-B89E
http://xpcx6erilkjced3j.18ey8e.top/6E20-96B6-A2B0-0098-B89E
http://xpcx6erilkjced3j.17gcun.top/6E20-96B6-A2B0-0098-B89E
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2181 2904 mshta.exe 2184 2904 mshta.exe 2186 2904 mshta.exe 2188 2904 mshta.exe 2190 2904 mshta.exe -
Contacts a large (1094) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3024 netsh.exe 2664 netsh.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: Cerber 5.exe File opened (read-only) \??\q: Cerber 5.exe File opened (read-only) \??\t: Cerber 5.exe File opened (read-only) \??\e: Cerber 5.exe File opened (read-only) \??\m: Cerber 5.exe File opened (read-only) \??\n: Cerber 5.exe File opened (read-only) \??\p: Cerber 5.exe File opened (read-only) \??\a: Cerber 5.exe File opened (read-only) \??\j: Cerber 5.exe File opened (read-only) \??\k: Cerber 5.exe File opened (read-only) \??\i: Cerber 5.exe File opened (read-only) \??\r: Cerber 5.exe File opened (read-only) \??\w: Cerber 5.exe File opened (read-only) \??\y: Cerber 5.exe File opened (read-only) \??\b: Cerber 5.exe File opened (read-only) \??\g: Cerber 5.exe File opened (read-only) \??\h: Cerber 5.exe File opened (read-only) \??\v: Cerber 5.exe File opened (read-only) \??\x: Cerber 5.exe File opened (read-only) \??\z: Cerber 5.exe File opened (read-only) \??\l: Cerber 5.exe File opened (read-only) \??\s: Cerber 5.exe File opened (read-only) \??\u: Cerber 5.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote Cerber 5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8E4B.bmp" Cerber 5.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\word Cerber 5.exe File opened for modification \??\c:\program files (x86)\office Cerber 5.exe File opened for modification \??\c:\program files (x86)\powerpoint Cerber 5.exe File opened for modification \??\c:\program files (x86)\steam Cerber 5.exe File opened for modification \??\c:\program files (x86)\ Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\program files (x86)\the bat! Cerber 5.exe File opened for modification \??\c:\program files (x86)\thunderbird Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\program files (x86)\onenote Cerber 5.exe File opened for modification \??\c:\program files (x86)\outlook Cerber 5.exe File opened for modification \??\c:\program files\ Cerber 5.exe File opened for modification \??\c:\program files (x86)\excel Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\program files (x86)\word Cerber 5.exe File opened for modification \??\c:\program files (x86)\bitcoin Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\office Cerber 5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam Cerber 5.exe File opened for modification \??\c:\windows\ Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel Cerber 5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 1412 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2840 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1820 PING.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2256 Cerber 5.exe Token: SeDebugPrivilege 1412 taskkill.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2256 Cerber 5.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2256 wrote to memory of 3024 2256 Cerber 5.exe 28 PID 2256 wrote to memory of 3024 2256 Cerber 5.exe 28 PID 2256 wrote to memory of 3024 2256 Cerber 5.exe 28 PID 2256 wrote to memory of 3024 2256 Cerber 5.exe 28 PID 2256 wrote to memory of 2664 2256 Cerber 5.exe 30 PID 2256 wrote to memory of 2664 2256 Cerber 5.exe 30 PID 2256 wrote to memory of 2664 2256 Cerber 5.exe 30 PID 2256 wrote to memory of 2664 2256 Cerber 5.exe 30 PID 2256 wrote to memory of 2904 2256 Cerber 5.exe 33 PID 2256 wrote to memory of 2904 2256 Cerber 5.exe 33 PID 2256 wrote to memory of 2904 2256 Cerber 5.exe 33 PID 2256 wrote to memory of 2904 2256 Cerber 5.exe 33 PID 2256 wrote to memory of 2840 2256 Cerber 5.exe 34 PID 2256 wrote to memory of 2840 2256 Cerber 5.exe 34 PID 2256 wrote to memory of 2840 2256 Cerber 5.exe 34 PID 2256 wrote to memory of 2840 2256 Cerber 5.exe 34 PID 2256 wrote to memory of 1228 2256 Cerber 5.exe 36 PID 2256 wrote to memory of 1228 2256 Cerber 5.exe 36 PID 2256 wrote to memory of 1228 2256 Cerber 5.exe 36 PID 2256 wrote to memory of 1228 2256 Cerber 5.exe 36 PID 1228 wrote to memory of 1412 1228 cmd.exe 38 PID 1228 wrote to memory of 1412 1228 cmd.exe 38 PID 1228 wrote to memory of 1412 1228 cmd.exe 38 PID 1228 wrote to memory of 1412 1228 cmd.exe 38 PID 1228 wrote to memory of 1820 1228 cmd.exe 40 PID 1228 wrote to memory of 1820 1228 cmd.exe 40 PID 1228 wrote to memory of 1820 1228 cmd.exe 40 PID 1228 wrote to memory of 1820 1228 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cerber 5.exe"C:\Users\Admin\AppData\Local\Temp\Cerber 5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
PID:3024
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
PID:2664
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___9WRSZ7E_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
PID:2904
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___CW0SLB_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "C"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1820
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
75KB
MD57385718e41cc00d0065290c1bdfde01d
SHA15afaa0d8f8c77b14563f3a15d59400249878b1f3
SHA2561c739d277065008d7aaf4329e9a01e02692ae78670d8344036e3adfdead8c157
SHA5124fb1351236089cdce4fd4f9e14a63af1bd700a5141cac98385d81d856201b244c3b15bf154bad9872d5d49df2d3f7a14dcf9cc11002ef260078d88a57c2a521e
-
Filesize
1KB
MD525916c526d65d9b6626435efcbe3aa3d
SHA114052272145e9ddd8760a011733ef3f78766be35
SHA25635656df81ad3cc41ea43b8c8a74db286e8315b2020934d631cafd0f6ce48b101
SHA5127e2cef8b565ff9a388606dc4a49bc9b2b76eadcb6c64469f1cd6ce47225ed74a83b17a7270f1a7f15f65abe8de05a1b1e75c3c81b6719e01e9b45bdd39593398