Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
02-06-2024 13:53
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/A026-A063-B6FC-029E-D700
http://cerberhhyed5frqa.qor499.top/A026-A063-B6FC-029E-D700
http://cerberhhyed5frqa.gkfit9.win/A026-A063-B6FC-029E-D700
http://cerberhhyed5frqa.305iot.win/A026-A063-B6FC-029E-D700
http://cerberhhyed5frqa.dkrti5.win/A026-A063-B6FC-029E-D700
http://cerberhhyed5frqa.onion/A026-A063-B6FC-029E-D700
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\compact.exe"C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\compact.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:448 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:448 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "compact.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\compact.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "compact.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3CAE3E55-C679-4095-8C97-94B09D36BA49} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\compact.exeC:\Users\Admin\AppData\Roaming\{50245C20-2B3C-C8AF-5CF7-BEB8122EA60A}\compact.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5f585c40026886ffcfea1abef05c01388
SHA1a0ee4a2d0480dbfdef1d89e808f8c11ee12e2958
SHA25639afa0c047415ba8969692b8f8afc0cd9f3a3f01f0cbec3ac42bf6ef2116626a
SHA51256bd98c828351fedd7ca481e48a4002ed7e81a8bc463c07c7aa1ab7ffa36164170b76cfc46a5fd66cc53d49e0b6ae93c81fc7f11670ba2437bea10899bbd1fb7
-
Filesize
10KB
MD5b90ec027b09feaa74179020d04bb2321
SHA10a5542c74f79163ff4f3db5e25640fde8cbff551
SHA256df8cdc2fd9b8d3fd9fef1804612dfc171c37a2af999b669a97c2d2decedf1a63
SHA5126b7d69395951fdf7f90f7be5309c9000fcdc29869feb1707c0221a1db462087d4c52643fb91c1dbe1f1adee61cffe0ef7ae652030bb8173f8ce052a03c9190d7
-
Filesize
85B
MD52a7fd45074ddffc2581bd1a017e94ea7
SHA1ab685c12eed11af7254a3c5c9666d3d0b96f2f8c
SHA256cbfe6a2ddf0216cf0b7c2eabf8de55b804dd8f8ac4bc485647590be4969211ff
SHA512854800d8430dd348befa429a65564eb441ba0a4ba9d1409307cbcd87952eb8268656015e5d5cf6c7357ff1dd9e64f4229071275f72319f2511c456eb133026d5
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5e99ff98b749947494c7196116987fa37
SHA15a31145bd6fc46c47e305c93afa56dfe362c40cf
SHA256a8a632784cfcf84db96c72e0e008c8d75c6e0603a5e75954ea21cc130f6c787c
SHA51215b3023eedc84a9c3d55c8e9afc393ed6cb26f5432e7a299f2a452db8bf0116cc460702345a8980ffe21e27a79a601fc212bacb0b59bf65a27ff2b4d69363a76
-
Filesize
342B
MD5c84dc777f1bccc714f6cec199bc5b56b
SHA149e0771d5d80920421c1ee53fcdf8e08792b30e3
SHA2566d85c18bb1d0e85d876ef0743f1feb632ec07cf2d8b24a2e6dde10e8d3a4f15e
SHA512a6faa72f01664e29c59405a5be076caff0140005d1753c0cdeabb76c18f801d3e894961637ed63cb1a5211e396292470fbd504224eabc92248488bffb7a577a6
-
Filesize
342B
MD5f52baa9b0e3d85d5e05341d19883eb1e
SHA100fe2d3af588d2afc22a5dbe2aacb53bb17845e8
SHA25614c62a7da28d9ebd1a07e0a01c16767cfd85d34f539e26fa45b7d27125c20562
SHA512bfef8dbca878c2d7edf23c5c62737f381a57db5d76109f1202d75f56c209e4350ab099577951d947852e461ac5f5f0f756d50b44c96dbef92ac5b3941fb05708
-
Filesize
342B
MD59d885e740368bb680aa9697bd86e6fa3
SHA1b11c15fed3b6a62e1f72a2641c6115d5ed77fff8
SHA256685f8a0cc7ae2e636456b106c27ea4a3dbcc70899fc105630ad43daec182c88f
SHA5121f38e9e553b4668f3e3ab6c9fd07a45463b6cd1f1197c52fdce820e3f50f13ad373e3317a151ce078c514f9db734a3d92708cba141e71e3a6c92fbfcf3277f5e
-
Filesize
342B
MD5dbdca067696586523a9ef8bfb3b8da41
SHA1425ec4a0478d0a8572c8e3de815d5c045f95e1bb
SHA256abc0ab687c82eb496abfd12eb27ac52124ba1afa9f63f9a99f7e74ba9b85bc55
SHA512c5fdb6a964efaab80b3beea2ce10b1c3111b9568ebef45d9bf49e4f7dc7f1d76c95e5c4a86a211c6b0df794e78982767260dfcb43a69310dcb3debf7b25ecf1a
-
Filesize
342B
MD576d9a40d341953cf1562443efc65faa7
SHA1d3ea468c0fed5282fc4d3545701f69af3d141b5b
SHA2563b5def07fccbe50f9cfe1926080757c1537bcbb9faff44ecb8a462fe9b080925
SHA5127579c090ae3423b5aa5d776c645dbc2aa90d79f763368723d50c4882548ab2becc3993c0a95543abaf750cd2faa4ad9d755c5e134d08194145341770e30b2961
-
Filesize
342B
MD502aafad408da3c27dc1a03f15bb93f0c
SHA1e7ea6eef2640282015aa926eb5941d1eb8bdf05c
SHA256e64c1f3b0801f33e902d93404abc4031f4b450c7a6e93d309d9d9e552b0f50c0
SHA5124d99e356c2c0c866135adc5a4c27641a0ac87f700b7e247d8045250b1e41b5530f9d47e6fba21a943821a20a295b3557ea0fbe7cd817dd82badf03d6bdf74821
-
Filesize
342B
MD56acfb5a3e603be5694ca3b19785416e6
SHA16214712796a4edfe290e244a5d415b189b517c53
SHA2568aa91ba45f1721c5ca867be9306222506ef42f559a33777003d80b885b69000c
SHA5122f7f647b1e1adeefcd36b8d2dc62cd6b4705e391c45e1b474274de2311ad0e81d339cfa7d72798aba7869d5eb518a3e49a59181e00a5db732d3811a55e7685c3
-
Filesize
342B
MD539e2a7d05f3f57181ab9de41faca4122
SHA1ac8243c0e90fb12dee4a0aa382162675ead23d25
SHA2569745e539da77d6043e628f99edf3686508d986c65b5a61bc8404c9fe28a28763
SHA51217e945dbd49f20f34edbd7bf2c2be83ad4fb510e49c707b66007ccdca75bc388e3733cbf955e429f1fe85cec3fcbeb564719f794e352add473ffa2b19258131d
-
Filesize
342B
MD57f687796d8e01d3e7d1a2ca63ccd24a9
SHA1e0cd8c03610fb04b4e7d72a25cdae004bc25d8bf
SHA2569094b40aede9dce63d346229866ec3f045a609e9722e9cba48e9181ebc9c8e13
SHA5124fe617d4934a6477f283a6db42461ab5190e550bff58200b2f7da6388fa84eb04793b153fb3b254371e6d1ff96a9b769e988d168dba8b229ca72ac84187c0343
-
Filesize
342B
MD541d85a2ae7a214fb9803b1925b2b41bb
SHA1cc9f2b961b9c98062dfbdb7b018faf58eb2c27c5
SHA2567795ca9d2e9eba7a83853c410223fa97b7069c97814c08e945c0cfd2d27410be
SHA51201ec60a82ea32702b41fa474965221895bb7453bc542f12062a9354769327c3b65f7a53bac93b7a72dc7d4081a49d4efcfa23cf5752b7a6641a9adb50d961cb1
-
Filesize
342B
MD5ea6b319c909b68442a982ba70dd2e496
SHA18c459876a100c1e94819a5003cedce36eda6b36f
SHA256b904697ae3b4388192bd5dd7328fd23e226d8c89edcebd4ab2fddc35008757ef
SHA5125f889657d741589478a3f9e7d3f606ea1e34ba8414d06aad04b0cd14b28facf8cb3ea831808704ae75383009180f94bb6bc5f180dbbcffca876b3e762dfb4735
-
Filesize
342B
MD54612790c62f752333a096347b2ff2f72
SHA1c521d6759dfcf1a7a6b8256cfd2377d53831e40d
SHA256603a0295cb40d1200a33ca460665c43802315c04096a28aae3f5e1f507a913a6
SHA5121acc488c60ab62d54b9a22cac22953af21ad5d23204ccbf8444d7344ac51614058800ba06f456ff9812bd493f1007a4b80e897cf1c22726f86f2d3262ebb7a73
-
Filesize
342B
MD5e9fa08f0b339fa3420af33bacecb0bad
SHA199fc87bc418b731174a8df354f0de10fab800477
SHA2567e3e9cefb2674a6b6c94ad833e7a818c71ea2170cfbb0d8f61c8038340220e8a
SHA512858bb66b660e2434b2f5dcbd1f42b42d2f2e247b1dac609534fd19b8ab6b503b6f501f461cc7c8482218cf01b3b6b1c31a1182ee84349ae836c30cc7bc96861d
-
Filesize
342B
MD594f771ab8c028c4b1f7fef745bcba121
SHA1f9c5adfe3a7af2cf64754f6762f4190e9cd1ca68
SHA256a942fe4e17e52b7a14d799ba4244dd6f500912ff97963fd1751ecdc2beb7ab7a
SHA5122d349e1601c5299ad9b3af46d60cba7cec34e029aef4570e9f6ead563dd0558a87a45e9554fc3202202779d752e219c7093e1d0b15a98c41eea023adfcca689d
-
Filesize
342B
MD57aa3e996bd0482ca65ef92a621d156e2
SHA1f554f0fca55dc6f9d185d440c8944071d638fd4f
SHA2562e26f4c5f3106149028ff4dac9bf4a09f9ee8574f3a96b27397e9a10cc7f879d
SHA512324c3e22723b93226b9a6b36ccf16f6ec9305fb0c75dbc2aa9741664f665fddfa0f89a7fb67838d4a8a5f822c0eefabebcc715664b663c84bdbb46bf06099f1b
-
Filesize
342B
MD58dbe3ab77a48e6ccd89348995e931ec9
SHA131230457c169f09773379fa5664e149893d1de18
SHA256e9da364899fb00a27a4addf343af60ce23b3b112a0ec22626582e5a767572b01
SHA512ef0b60570e63b249fb430eaccecd75886a33ecbe622b07f10ac5de61102f16c5e3fe9c93f889359aaf24a6b9bb86c1bf591ec2b65ea950fc594dbd1aed63c0ad
-
Filesize
342B
MD53ce40717ec31335ce274bde29a1e2e62
SHA17e47fb83e39dfc23e6a3e8fa5ec6550609406ccc
SHA256cdc72cccf95adbdd1d347e562bd78c412344d3d996755555bbd2697a89189e36
SHA51292003349a5156364f20b3ffc2cd111981f2b40b8e029c23b986461db50d4e71ad1e8202e5dbc547d690fb0870ee17b5b4753b58ad54b6333f553ecd575fa70ec
-
Filesize
342B
MD53265e02e2c925c53d06fd4739eba1f39
SHA1ca8a8f99c1fdd2485a953878e0bcfce27de4810e
SHA256e9557c3fa5abc4235665381c1f47c9da5b3eb77a12d1734842f47da61f44687d
SHA51241a743abdd010277f3fc99bc18176d5ede439fc477474a4b2da3c9c53faad5ddeb87a30909cd33148bff480baf473744dfee5e5d2d8f80430da8d406fd8486b3
-
Filesize
5KB
MD5f576aae0fe33650abc38d5975b89e157
SHA13b9f9cfa5e4cb5bf04ba3039ecf3e8eba1694813
SHA25641fa90475340053611fb256bbf2e200f6fa7ffe0894efc1de3e67d713a8393a8
SHA5127e797fd792b4c183a87b1823aa9a8566182b14f0eedd51f16eed31f82acab9a7ed549582e1cfb999bc2a40dbbe873dca3d70b58ac801f9effaef72da1464e684
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD505a5380e3a21d1509b9ffc3ee6714c0b
SHA1b22dc8e7267b31405e59789d6a7b2556475245f6
SHA256d5ec3f7f6bfd7e2e573e75a1d87bb9d762b1dba3bc2661ede389e7a6ef4a88f3
SHA5122dede7bdcac1e4c0dcacaa33835a872edfd2b51f01bb1730498bb5268e376ebe199dabe28ff81b5d5c788c93246e96fa6be0a44836c3915ea26b8250943f773e
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB