Analysis
-
max time kernel
129s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
29-05-2024 15:40
General
-
Target
VirusShare_270b70bad151a515136f553e5bc880ac.exe
-
Size
344KB
-
MD5
270b70bad151a515136f553e5bc880ac
-
SHA1
77b7def336c7647c6faadaf7136d70ff1e9ba7fc
-
SHA256
db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
-
SHA512
c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
SSDEEP
3072:v5sAzvcjE+lcO3zXgKRcP66BpwwB9RStc3Yfqr:v5jvc4+lcO3zQKSPfBJXv3YM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.vmfu48.win/66FA-FA76-D1D3-0073-1239
http://cerberhhyed5frqa.45tori.win/66FA-FA76-D1D3-0073-1239
http://cerberhhyed5frqa.fkr84i.win/66FA-FA76-D1D3-0073-1239
http://cerberhhyed5frqa.fkri48.win/66FA-FA76-D1D3-0073-1239
http://cerberhhyed5frqa.djre89.win/66FA-FA76-D1D3-0073-1239
http://cerberhhyed5frqa.onion/66FA-FA76-D1D3-0073-1239
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\cacls.exe"C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\cacls.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "cacls.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\cacls.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "cacls.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD53bc8ee33045b5757b018559888dfa4b6
SHA1e93f9ff2f3a6d564c3b9a72c1b5b50e2f12af028
SHA256ceff5b284038818065ad9290eac5962724cacc46c9fce627fbb361950c405aef
SHA512e9b67d84626027fbaaeeebe423580d3e187316c9183c93972ad3257a496fe57ece6a9a344c107091e75cc381bf0580aa44b956c4d023ac0141d84d0a3bd14c6e
-
Filesize
10KB
MD538dde2a37c2deda31af968b79b416514
SHA1ed1777b00178d12bb53fdf2d645ec91b0eef64fb
SHA25668a5d780b4199e36c882e9e8a8956774a2365618fe7bc95cf4299e8e21ff8dd2
SHA51272b81a1dc5ed0d2f913512cf92cb6301c639953f11d7ec12ddcff3261a560be96850332b1051f2f5117d1986aa79e1cdcd3ce53ceb2a753b25f880edf6650075
-
Filesize
85B
MD5a6859c5579ee4f26f84000eb62e4b0c4
SHA1850d4e000cb340e1b0eb2bb54749acf997f8d760
SHA2564fee368ddfb0520ca62b655c6d6caf453b4c2053db4f3904572a3295c69229f8
SHA512bf24188a8658ac88b624eb7eef613ed7521a1195982f0101604bdea834d51fe2d0a5b97961fa61b858de499639a700e0e19e4c9f3f106dd63e1efb8d01503aba
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5c110cfa8309ca0f86102a6b50a0bff30
SHA1e36e0416a3994c546e7ec8d4749a33d3b96afbf1
SHA2568e13c1ca12f4f48a378c7a5a096a557e6a24cdf9540dfae3b803610465cca01b
SHA5126532b10753f4b74fdce40c795e4eb879916512fc6f728c2a923de1c753c0cd5fb3fa7bfabe94528b0bb04b3ba3f3dd6a3202aed831c562ad3bf1ebef8964254d
-
Filesize
342B
MD5b78c87b33f65aed5cbcc7ca3ec5c75c5
SHA1d4765171ff07bfc14da0c55d7058d1bd2b8e8007
SHA256e2412bdcc3bcf25da49d69db7dff61536987e6231b96e13c4ccec3da3d0ebdf4
SHA5126a210fff15e07b89455387a9ece4627807bafd7624a9285e879d5feb60cf73b8ee65dd8ad994285ff717f260157810a93c9fff8a076be43c79d457df35f4a183
-
Filesize
342B
MD5b641c064276649076fe70e68f1c97660
SHA1c024eaed13207a4814df4b61f02cb532e0943d81
SHA2563b152eef46ea251d62f6c8cb119548921f1c1e307a7138517011c20881ba65b5
SHA512a79ffbdcd4dd93b54e7f943b016e3cea68eda38d283385e2666b06e048b47362322ac676016b60bfd4b374598158801019933815c4401b59e59f0395e72c08ec
-
Filesize
342B
MD5fdf6d4366ddae5bd48bc366744e6f300
SHA176341e49338a1c85354e81874b081a502b7355c1
SHA25618d3120de2ef7f22d3a481a48408b4b5e614b59550a565fd79889d545a83adf8
SHA512e274f51e08f232b24b178d421a7f5b4d1eed61a0e190f4a13418e082edfa78e8b247637e4c376739afedacb4231a01e9ce2375d06e9e001b5c20112ee47e1ec9
-
Filesize
342B
MD57ce8b2f4343d691fea6001828312a88c
SHA168073872c0e4784ff7cbd7ee499c4d84da001bde
SHA25622da877a4b320698edd4d49c14eb623bb33ce74408858e84f501df35e5f3a585
SHA5123c446430b026e22433dee10c857cb5b0d6cc3a2529af8400db5764c1f1f2172e56822ad8823d273e2843fd604db98e5238a9ff5fed14c509fe8b37b4287aea5f
-
Filesize
342B
MD5c8737ad96e8b9d4d4dc08c2e5f15174a
SHA1573a24c93030a9b06793ae11736242171c75bb8c
SHA25692a3eece0362ff86f9cd89dfbd47bc75f128e62d0c26c5397bfc6fc8c513ec45
SHA5127e536db1bf17556f088a1f47c1442ce9ca0d76024ec8dda5e484f77c931f4e614eba0b90cc45256fb655d73afa5da8582db2d5c255a7d7c19d45a15ef2972026
-
Filesize
342B
MD59682eb404c871e34429c78c58db67aa3
SHA1ad92b4c41331b82a8632946a483ca53712885ceb
SHA2567f3045f425ce17d6ce965611a940165aee28756a51d8d9ddd19f13828ee5c7a7
SHA512a8b608e9de00ffe87e1b118d0064794725316e8bf82649ee964a947b58493bedfd9951854f46691d4acbce43763b2079c178d14b532c56c37c17f1d01e134020
-
Filesize
342B
MD54d69e760a50c061980e3293e2171b142
SHA1eb9c9d8858bf3a2ad38315c6fa5f3ee11682e176
SHA25616440d3e2795f81eee4afc7c77e6a73edda968d753100125f4cb2708f651fd19
SHA5122ba95a06e1d01447d91821e2132ff8924de5ddb6a4ffa715545d45b5385e292f7ed9f8f8d92b213737d61f16fc5d8c9caf55142bb691b5da90bd29a525206363
-
Filesize
342B
MD5e582a7a188995218b042acb84843fc13
SHA129e4ee9706d10fd79df3031c91b82dca0a9dc0b2
SHA256ffccf1b696bc423b35ef3e043184132038005724bb3d4624c8d8d13b00e7fb05
SHA5122488b243cee053c32dd4066bd42364bcf0e468a0721760e894543ff3b3045c2d0b3c8edba8b949c323d9397e482fda63668eab2f3523317977d80ba101d0b94c
-
Filesize
342B
MD5b46cea70f86b3999ed2c64bc7b87ff9b
SHA1deff73da2847cd2f23450d54f198bc975e0afd6d
SHA25648187433eb82fefa9a11c0838acec9974800f229625e8ed3895b5e7f8d80c6dd
SHA51290f8606c53a43132df5ebaf64a329a04fa84d685c3220b847b24b20b60934842f1012b9b8845755b784a9bcfa99753cc9c1f6ab500b2f8d52ac0177da6f63b89
-
Filesize
342B
MD5bd1e801efbb6e47fec02849aacd0abb4
SHA1eb8d3f144a258c16b51cf852e945ac1a6f294c20
SHA256e24745658a02504f2e31e13a599e79a5638797d0e7f6758cbd213c44f3f82b4f
SHA51283fef270645f85205501999e148f8a1513e3aaee571ef359347bfa5b347b53f3d26a5ad37eb6ae953274604c072dca0fc6f3bdef831ab9269745ecd9c09c6573
-
Filesize
342B
MD503d7ad37b51d54bdf9b29dbd15509a84
SHA18016f2e0cbb4f3a8f0b755ce7ea15ba2fd954d4f
SHA2569b7ef71c0e0f15ca01d9107aa0c465369d3204711398225f15bc8de59e8f9e39
SHA512fd3868dc39c333d597d60dc6e2e1004bbb60c6b5027e652966e9edd4b63c8a2f557f5844944da6cc0f0762aac49de61d48cdbd4a4f902f163423831369d1bc5c
-
Filesize
342B
MD55048459930c1936bb1022910ece309b7
SHA19f5e794c81fe70dc8bf84461094861d8be20f06a
SHA2567345922f8ffdb359bb7781f9b5dd0ddbda8eee7b449894f6423e3593fb62a43e
SHA512d026940bd8debdc60a0338e85a62fd1cb512d6d2ae498b5620a473b1c5b96a0b5094c932f901c4c0febb7ea99d5538bf598e50aed44d70bc433f1f7ee316147d
-
Filesize
342B
MD5b2891ebead26d0752712135da026c6d8
SHA1e1c1eec5571318d30fc44869c54c23f91fb9414b
SHA2568538d0f30c4f20b08c47c4bb34715e278f44878bf892a5d8f2bb3ed693141058
SHA512b377dd31d5d4aa9431564d67f8fc3486442e1b579bc36202f2e32a97127d3796603c9f0f361c700e643515f4e7306905d508b07c2388255e66a111072142f37c
-
Filesize
342B
MD5426458ef8912f83f05b6c96697ed1258
SHA1522f982fd953d6e17cd86108579465afc3914e8b
SHA2569a51de826f78855400061412d926c7a8f41f3c2e32030a959f43dff4764493ab
SHA5122979be9e1280c2c64e9320df23eeeb65587ca3184965fe17f5857ac9efb644287e1b8e3b13066b56f5c132d8ed4d49b84532ef5d9da09c97abb1db653d627223
-
Filesize
342B
MD598c8b83ab87a14a6a26d44a735019c98
SHA1a70039d0fae64f3e0dfa08ac458e48208d9b7655
SHA2560d7c8ccee1ee25cba65f83f1ee21544ea857eb22d253c6799642f461d6856e6a
SHA512e222e999817deeb4fb3ccdce6628789a1b6af92132c9c0395991cc3d3b92ed94143a91b8b73cda2b641612e4d8b93969c427a448af7d8ca030cad7aabeda5d94
-
Filesize
342B
MD54be0edf6be095d43a05cf3e41ff3b842
SHA1400c5b4b7d778966fadfdcc830a1136a47cefaf1
SHA25649e1a801014b86c598f548d9547778852b875f345be6e07602711d0e1d4c3fa7
SHA512c741106780c7924ad9a0a00bd4eea02605a9caf112ba645ad73ba99ead0648d2ad7214c630b4d8b4da340d1f2f28586f9209707ef7975b7538653417da162b0c
-
Filesize
342B
MD557e1c698b00950d86ca9ec58bee5d440
SHA1f09197e4831895c88834103e326b2fe3845b27a4
SHA25600a855cd19f0f148e6923b07645ac15ef7b252084f42cddebb14111fcc95cc8d
SHA512a64d4562eab97a6854e85011f38bed3ece27583bf015e6bfe8f1d15db687debf8413241a35c06274727e18a3f66f49b40a77537a0ab473a2efc2312ce3cd49e2
-
Filesize
5KB
MD50652403954be36304ea98775881e1563
SHA11bf5f8e3db6c5057bddd81749a83b97377800d50
SHA256e837aff2b1d6b06022d29adf9f638ea5a3fc0198dfca420367b23b016da309d3
SHA512d1d242e16aaee98fe7a157f20d5183a2858c346c1035c6929c50cbfbb6896598d5bdb2f91b4bc36edf57639d51b612dfc2f4802ede41ed946c896a78c1994984
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD537f4fc807dfa76574dec5d8e1247b83a
SHA19b7708a5eaae2e4085ba4736066f9f035b9e85a1
SHA256be4c981c23402258f68837effd2ebec8dd398edf94c3b33031d7eaa4977d6509
SHA5126f35d4c3aa242a5dd970af58d289b9d9ca979aa9cabf573a5da3f8392cf904e58621412bd70af490b4fe107f67c12ce9b4603f84d2d35a2896f9bec89a512828
-
Filesize
344KB
MD5270b70bad151a515136f553e5bc880ac
SHA177b7def336c7647c6faadaf7136d70ff1e9ba7fc
SHA256db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
SHA512c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
Filesize
120KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB