Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
02-06-2024 13:45
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/0FD1-47C7-1508-029E-DC22
http://cerberhhyed5frqa.qor499.top/0FD1-47C7-1508-029E-DC22
http://cerberhhyed5frqa.gkfit9.win/0FD1-47C7-1508-029E-DC22
http://cerberhhyed5frqa.305iot.win/0FD1-47C7-1508-029E-DC22
http://cerberhhyed5frqa.dkrti5.win/0FD1-47C7-1508-029E-DC22
http://cerberhhyed5frqa.onion/0FD1-47C7-1508-029E-DC22
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\fixmapi.exe"C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\fixmapi.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:668673 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "fixmapi.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\fixmapi.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "fixmapi.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {52124397-795C-4017-98E8-898322AA5F10} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\fixmapi.exeC:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\fixmapi.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5ff068ed0d0c7bd06d8cebd34ebc0186d
SHA1503fe3cc85e993690c6d2263ab5faadb6d8adf83
SHA256caf07bed729d6043fd985e02c26a0b5c74835c579cd5344e54d3dedf03b7e68b
SHA512f4a8c23ec94cba784388732207298823aec9109b2b41af2e1d79723229fdcf89a20421905d0bb2b5b95acb6f9efbc3874fbf5c83b87c5d08cfc87bc90b73d49a
-
Filesize
10KB
MD57fbc3536afe719f6b7150b99754b33ca
SHA164dfd06de3069e2e6574867facd97be28d7060ea
SHA2566eba2e72088befc121f1d5f1ed897a8bb21ead4d679c4335ba3fdbf4ba08230d
SHA5120bcc60a87d35db9dea93a9304955742c255b6d1214a3b9cbe38748b6ceff2fd696033c6e720463d101d3a3aae43bec5fbab32b83e31c6d4359125acdc39d0b65
-
Filesize
85B
MD52d829b3b9e97b9f798d080f50091bbea
SHA1d7a0ed7dee1557164cc089f3fcf755d73789fd2a
SHA2564950e218720d17aca467c7e86462d3f3752d37968c3f7c5ad85cec564ef929ac
SHA51239d229769e98d857d531ab4bca837d763d7e25dc612224a451980d7a478f44fc88ce7c8eb04b9ae3064a37682bb04eedf9e3d0e874c023c868a34617d4442e9d
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD52f9c38eadc9afb584cb1305f28e9471d
SHA128553d853aa58400721a8753a41e99a551e3ab54
SHA25614e787e674acf57c4b8ed4a2a61b9e5df7e52fb6f4a08954875bcabc06d0ca1e
SHA5125a13969c90d316f0e6be60ec366f775326858a9c5df6402a88684c0fe2f6f19e186272376ee44916307645220730b952943ea16bbceae93d1ff895b17d3a2a9c
-
Filesize
342B
MD5cfb377514633ca19ed2c66e4772f49c2
SHA1bb7fcf6a4680bfe523c74b95cc8490adba869113
SHA2562972c9ba769ef98c9b18882014350295e37f9f43b412c2ce2459f4cd09dbc3b1
SHA512fe3e422de27d9a5b9573a481fa815060605cdcf8717dfdd9a1533bcb9e4672e1c333e56a70d3f40267f49f4783530971cdbb0ddf93c840e72e5d1d70479ea96f
-
Filesize
342B
MD57abe5e12eed6eb5a1e2ebbdedea57d32
SHA1c0f751bb0e3ab8c2de1d64879f5584c0877375bc
SHA25647821e1019ca1e0b72d22d0b0fce26104cbcaa832ede4ac4faa670f1a72557af
SHA5129fa520af75d877bc7fef77cc1063f7ab29bf16d699c9c5598688220e33f3741b288edf60ce64d0c851ec473e6bf7063d1f914e8b8a722a0fde931cecfecfbea8
-
Filesize
342B
MD5f3995c2e37090972a2043da49b1f0ec9
SHA12082bc69c44b2b43ebe151bc43b31c285527fb76
SHA2569d0ad261eabe1cfc50003681b085935705706290a85c7e9c4a53226834a5a22c
SHA51235e153acc8de720d4d6129e5a0da873d830726097175ef7052e9fc2af8c6b8682afec9398124e7db453906644445c9e3356013755a3d0183b314649750e08784
-
Filesize
342B
MD54e6e0f60d7c857a7ebbc30ee0200f92f
SHA17bd32eb827c0424eff2a6c8bcd8b32d43505c16b
SHA2560dbc6ebc0393d171d9a75ebb7d30288a78cde9967b86f303c1eb3aa0310ffe15
SHA512a5996c1461a14a01df4d38024a3186ec85f58a9b271ee62817681884f4b5dea9ad441368a07d13a0a45f58c54b2a123da07f54a39cd0811a634a166eae519701
-
Filesize
342B
MD558f73a43f2738c51fcd4dd68248e210b
SHA1048127de44ffc9d48f527ec8db5514716352d3da
SHA2561ac6354b69eaf3794724d761c428b0b2b3bff5b5320ac4854972a6230c060844
SHA512af8e4f67e7a98a964cb019b30de2be01e85bcdd7d29ebe896cd2d4df71c7915ceb6e4c759b053a0a8be22cb4cbec1c358c4f29b4d7af3b41fa3bc363c06ff1de
-
Filesize
342B
MD5ab39e49d5bef6bd23981e55bc04242c3
SHA1fb6547b465f6a5cc251bdb7f94c397e0ca3f915d
SHA2568093a3b25e78673e819b0a90e2ac9bc5749b25ad63f8eca58287982da9686c93
SHA5124f7ad5f8bc8f8afc36c57e7ba1f642ad174d581cbefad74c592c5840574fbdaef4ceb4e82d5828f19173e6ceaafa2f5728b780f6ec4c6e53164387188fca526e
-
Filesize
342B
MD5abf9b1ba70780b599b1b69e282a0de20
SHA11f148944aa0cbe44eb760758c574bbf5c8422f1b
SHA256297f99eee482cbbe54b604eb55768e5dc92d3a75149937d32ca8417094e77e37
SHA51205ab0a9d0a66cd089f9f6a6332e57289ebf607efc1fea5f6881bac3e4d9aff27f6addb2e3db17e72cb457547f90be4192f8ccaf8265733628d9d3fcce1578d8b
-
Filesize
342B
MD57cbe827a3f57daf4c81196517617512f
SHA19af1fa2fc2d2ab1d710c1064af17ed33e8237be8
SHA256edef5171419b89506de641d994e364bc8b9e0f6a8bece8877e12fdaacef36aff
SHA5123aea4e30e08f3979e599961c55ba4fe0680fac2cf663b018cb378d6f2098a7625a39a609f0a61524c3675f874bd52c5d37387f9c9fff9c31f8aa232480d86685
-
Filesize
342B
MD5f4cb02235aad9a38f4652108f50f9bfb
SHA1b58524eeb09c2fa89e2e135b2720c66d67f9a443
SHA25644487f92873af2c8d1845becf7d497fb915b4eda3889f0396ae16171101375a2
SHA5124f354ae215078ee1f02992bc003def35242e768d716add5f65037a4b8a0d428102c86a02103d2b4da0edbf46fb831e8c2fbb8dc5babe3fea2a22e3d5256fd387
-
Filesize
342B
MD5fbd951c7ab8fc0f278e913c4b0f74e1d
SHA155b3452c78390c3b95f774dcba00c62e22b097a0
SHA256179768b6f88c51ea2545ab6f6086282ace94ecf7fc4633109df00c55dfde46a8
SHA5128d9f7f545a5f9de7ea7df30e25cbe0b745050d695d4c15ac4bdace0e585c8079818ef65d16438f5b2e23bd4d3f849228ad49706428858568773825190aa0ac77
-
Filesize
342B
MD553c56a377b18bd44938b76a15c0062d9
SHA1579b096f557580dcc17394a373d31499a8b2925b
SHA256b723d524a74963e5cf0503b991f50d863e8c00e1a16b9891cc02aedc4f11346d
SHA5127c1d6bd16a84fc01e34873adeba86b89c8a2b63192064d80765b183d0dc4f0449e848328d98baafe347ec18a4b057ccb01813b70f9390354a88074f32c776c20
-
Filesize
342B
MD5896734e515743a8d08d80d1e270ba288
SHA13bc4442ad9c680f817626f1e4c7f0a5b367f4cf1
SHA256aaa0ad1ddffae7805df914b00a8c070919458439c308057e0d11e8ac7a782a59
SHA512d62e9414bfd3f57ce8ff87796e01d28cc61b083ebe9bda821ce6cf4a1884adfa356b248b024dc332b2b32fc112bbf785363ade34065ee257abc712e13d099480
-
Filesize
342B
MD52f74e97e87defaeb38aac75bd9436150
SHA1bb9865c39a96a3305569b29aaa4bc9f8b06d7e84
SHA2564ae617042f5f214daaca9d4517856895691337ba245bccf4322e776cd4d0c399
SHA5128944f8daa4e9c1260632917b322cfa6c3aac0fb47f66038c7484fb538c107f523ad309572c501b6e87e75e52445fc7f61a7d94b994bf285b0902d7e96c392a34
-
Filesize
342B
MD56c858d44f288600041672001b78c185f
SHA13d0ed38f62cf2bd9d90c64c7e3bfc82c12d3b995
SHA256fb07620ae24eed6f5582649afcf1a22ed03bcb5afa7f912fd9118707d00e2c5b
SHA5123d20956935c88b0e2db8995f13984334012332758d6bbae48d1f64b3e1b8e33706fa8841eb1d56cd612964aaea53041a056144ad779f6987734a3fba9ea0eefc
-
Filesize
342B
MD57350af07bbeb2e13bc868b71cd825ab1
SHA11c6d614a14dfe2e3bd4fddc37e8442d7523c18d7
SHA256b946441eaa5cace08ca77e21269db98566847f4b1ade4e1adcb425aabfaade97
SHA51248c74e3cab7f1289d5ddafcc863ec90b3b1581b0253d47993cc1d2e842bcfe3d9883cc4438369479fd58fc48b4c83a62530d9054fa809fd1633e107ceb72e5b0
-
Filesize
342B
MD51ad7017954645f138a44e746cd53563a
SHA1e2300f944df01155b659e0056e09df9f6be83b36
SHA256356e7f5de7519ff0c22fe462d6be0afc789323ae0eaf02f4425f8d167cd038a1
SHA51201c031fffd8bbcf677da03a7e4cbb231c1b26576ce39742e4638ff400765d27311a3d2790f1f5feeb989c413cc66bb19f5205f314af7d9580b8c97f8f917aa9c
-
Filesize
342B
MD5522b1efe1c930096380f52d49cf3eb80
SHA1eb1eef6ed093170c50b7ffc4ea9e49d6a80902ce
SHA256aa915251f952b34aaccf66f346b7449124c1c2c5f8425697e8791e7e517efa1d
SHA5125fc135f379e9b1fb553fa83df6273fd46a3d66a49c804de1350bb5bc7a070a5cb20af4d0abed45cd4e8c2b2ab699a456322da42273e2e3006cd81f665db5377d
-
Filesize
342B
MD5bf771f1a73dc7c650c75770ae02b8e1b
SHA1845751851fa447e05383241a9a1ade934e07b4c6
SHA256eacbb0afc83e29012efcdde29eb2318a7fb30b06070306a288c5b3ff4363c8bc
SHA512951a1024ae11a99f73264f7a4c2fc16a7927fa0c2eb7f8d5517d2045373eaacfad9de7da6ff1d8f411931144f23867a30923428a024b80985a2bf54f208afbf7
-
Filesize
5KB
MD542d2497d32849358ee2154c0e9514a81
SHA15de731c645e7db252e5e160274d3d5ac8eb64efb
SHA256c3a64f398037ccc912a7b56660b5060b2fac113bf458c99285b0c890887457e7
SHA512651e1f24389098fc15f8c0b2c36fe675bdb5d726f4b3a62efa7dd2d74fdd3b82b9ea8b0ae2a5c20b7cc40bf658c5683cac4d8b2c04383030a6ae29e46b73c890
-
Filesize
3KB
MD5a2224caf91865585c8915fba2be68e56
SHA1378017ef9054380813207795a0d3950ca52f59dc
SHA256afbba27bc932f0b1f1cf78cb524a598ec9634fde2f9ab1d266d253df66b11392
SHA5128651513d5173a02d0597c30629c4c9ea39a345958089d304f0caded65b0546b41b8f47c5218a04065c3a3d6eec17d3b6979c5e7bc13e5b679bc3731152c218c7
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD57a399f7d4a244388bcd761e4460e8fc4
SHA1bcedcbedcc496a40c702f282d7039a1ee01f0e9d
SHA256fa4a1908521a8db88d7bbd11682830038ab93da55b2237fa645c0d2588e8a957
SHA512420b64b02b3a21585a439a1c4304ef3f95b7e33bbf4d5edbd3a35e0ca04133754219b231394b817602d34f83dede00b91039fb2d400c6ce0d50bf76879357d42
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
200KB