Overview
overview
10Static
static
77ev3n.exe
windows7-x64
7ev3n.exe
windows10-2004-x64
Annabelle.exe
windows7-x64
Annabelle.exe
windows10-2004-x64
BadRabbit.exe
windows7-x64
BadRabbit.exe
windows10-2004-x64
Birele.exe
windows10-2004-x64
10Cerber 5.exe
windows7-x64
10Cerber 5.exe
windows10-2004-x64
10Darkside.exe
windows7-x64
10Darkside.exe
windows10-2004-x64
10DeriaLock.exe
windows7-x64
7DeriaLock.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 21:34
Behavioral task
behavioral1
Sample
7ev3n.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ev3n.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Annabelle.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Annabelle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
BadRabbit.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
BadRabbit.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
Birele.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cerber 5.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
Cerber 5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral10
Sample
Darkside.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral11
Sample
Darkside.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
DeriaLock.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
DeriaLock.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Cerber 5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___PU7Y_.txt
Family
cerber
Ransom Note
Hi, I'am CRBR ENCRYPTOR ;)
-----
ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
-----
The only one way to decrypt your files is to receive the private key and decryption program.
To receive the private key and decryption program go to any decrypted folder,
inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions
how to decrypt your files.
If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below:
-----
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://xpcx6erilkjced3j.onion/FBFC-98AA-3A34-0098-B0FB
Note! This page is available via "Tor Browser" only.
-----
Also you can use temporary addresses on your personal page without using "Tor Browser".
-----
1. http://xpcx6erilkjced3j.1n5mod.top/FBFC-98AA-3A34-0098-B0FB
2. http://xpcx6erilkjced3j.19kdeh.top/FBFC-98AA-3A34-0098-B0FB
3. http://xpcx6erilkjced3j.1mpsnr.top/FBFC-98AA-3A34-0098-B0FB
4. http://xpcx6erilkjced3j.18ey8e.top/FBFC-98AA-3A34-0098-B0FB
5. http://xpcx6erilkjced3j.17gcun.top/FBFC-98AA-3A34-0098-B0FB
-----
Note! These are temporary addresses! They will be available for a limited amount of time!
-----
URLs
http://xpcx6erilkjced3j.onion/FBFC-98AA-3A34-0098-B0FB
http://xpcx6erilkjced3j.1n5mod.top/FBFC-98AA-3A34-0098-B0FB
http://xpcx6erilkjced3j.19kdeh.top/FBFC-98AA-3A34-0098-B0FB
http://xpcx6erilkjced3j.1mpsnr.top/FBFC-98AA-3A34-0098-B0FB
http://xpcx6erilkjced3j.18ey8e.top/FBFC-98AA-3A34-0098-B0FB
http://xpcx6erilkjced3j.17gcun.top/FBFC-98AA-3A34-0098-B0FB
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1107) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1704 netsh.exe 460 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation Cerber 5.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ Cerber 5.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: Cerber 5.exe File opened (read-only) \??\l: Cerber 5.exe File opened (read-only) \??\q: Cerber 5.exe File opened (read-only) \??\r: Cerber 5.exe File opened (read-only) \??\a: Cerber 5.exe File opened (read-only) \??\e: Cerber 5.exe File opened (read-only) \??\k: Cerber 5.exe File opened (read-only) \??\m: Cerber 5.exe File opened (read-only) \??\u: Cerber 5.exe File opened (read-only) \??\v: Cerber 5.exe File opened (read-only) \??\y: Cerber 5.exe File opened (read-only) \??\z: Cerber 5.exe File opened (read-only) \??\g: Cerber 5.exe File opened (read-only) \??\h: Cerber 5.exe File opened (read-only) \??\j: Cerber 5.exe File opened (read-only) \??\p: Cerber 5.exe File opened (read-only) \??\t: Cerber 5.exe File opened (read-only) \??\w: Cerber 5.exe File opened (read-only) \??\x: Cerber 5.exe File opened (read-only) \??\b: Cerber 5.exe File opened (read-only) \??\n: Cerber 5.exe File opened (read-only) \??\o: Cerber 5.exe File opened (read-only) \??\s: Cerber 5.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office Cerber 5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam Cerber 5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDC18.bmp" Cerber 5.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\onenote Cerber 5.exe File opened for modification \??\c:\program files (x86)\excel Cerber 5.exe File opened for modification \??\c:\program files (x86)\office Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\word Cerber 5.exe File opened for modification \??\c:\program files (x86)\thunderbird Cerber 5.exe File opened for modification \??\c:\program files (x86)\ Cerber 5.exe File opened for modification \??\c:\program files (x86)\bitcoin Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\office Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\program files (x86)\outlook Cerber 5.exe File opened for modification \??\c:\program files (x86)\the bat! Cerber 5.exe File opened for modification \??\c:\program files (x86)\word Cerber 5.exe File opened for modification \??\c:\program files\ Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Cerber 5.exe File opened for modification \??\c:\program files (x86)\powerpoint Cerber 5.exe File opened for modification \??\c:\program files (x86)\steam Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Cerber 5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! Cerber 5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird Cerber 5.exe File opened for modification \??\c:\windows\ Cerber 5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2856 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings Cerber 5.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4620 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3436 PING.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 1000 Cerber 5.exe Token: SeCreatePagefilePrivilege 1000 Cerber 5.exe Token: SeDebugPrivilege 2856 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1704 1000 Cerber 5.exe 98 PID 1000 wrote to memory of 1704 1000 Cerber 5.exe 98 PID 1000 wrote to memory of 1704 1000 Cerber 5.exe 98 PID 1000 wrote to memory of 460 1000 Cerber 5.exe 100 PID 1000 wrote to memory of 460 1000 Cerber 5.exe 100 PID 1000 wrote to memory of 460 1000 Cerber 5.exe 100 PID 1000 wrote to memory of 4664 1000 Cerber 5.exe 114 PID 1000 wrote to memory of 4664 1000 Cerber 5.exe 114 PID 1000 wrote to memory of 4664 1000 Cerber 5.exe 114 PID 1000 wrote to memory of 4620 1000 Cerber 5.exe 115 PID 1000 wrote to memory of 4620 1000 Cerber 5.exe 115 PID 1000 wrote to memory of 4620 1000 Cerber 5.exe 115 PID 1000 wrote to memory of 4908 1000 Cerber 5.exe 117 PID 1000 wrote to memory of 4908 1000 Cerber 5.exe 117 PID 1000 wrote to memory of 4908 1000 Cerber 5.exe 117 PID 4908 wrote to memory of 2856 4908 cmd.exe 119 PID 4908 wrote to memory of 2856 4908 cmd.exe 119 PID 4908 wrote to memory of 2856 4908 cmd.exe 119 PID 4908 wrote to memory of 3436 4908 cmd.exe 120 PID 4908 wrote to memory of 3436 4908 cmd.exe 120 PID 4908 wrote to memory of 3436 4908 cmd.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cerber 5.exe"C:\Users\Admin\AppData\Local\Temp\Cerber 5.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
PID:1704
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
PID:460
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___TGKY841_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:4664
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___DG1FT_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:4620
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "C"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:3436
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:81⤵PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59bb3fba5bafeee0d869c99b5f1589698
SHA19c2b656e6b3c193caf77e7f85d6542efebd0cf6e
SHA2561ae2d75a8ca8432e5fc28cd8c203cc3e2af763a3671009604d95aeb4244b5b8b
SHA5123a83a7c8e16b9b3f0aa1709b413a91af7568f6e2799434b75b6d18e73788edb166b791709338ad2de30c81a280d69c0f9854e043db429ca4b6eaac8a6750bcd6
-
Filesize
76KB
MD57e4ab16ee0bb9d2f86cf8aa64eca452b
SHA1c670c719f0f05b290cc5cad9b7c81f3dd90ac05e
SHA2561950285cb45c005853e116f395febed9a2e69c7201f8e8e9df58e8b8ef376a39
SHA51230fae23f96b871ff9fadf05abfba833a02e59f5ea222fe30553264239f328876d023b7d1ffc5f5f017148885d75a64dbd37e7722ea874b8c83b529e50676a543