Analysis
-
max time kernel
127s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
02-06-2024 13:33
General
-
Target
VirusShare_270b70bad151a515136f553e5bc880ac.exe
-
Size
344KB
-
MD5
270b70bad151a515136f553e5bc880ac
-
SHA1
77b7def336c7647c6faadaf7136d70ff1e9ba7fc
-
SHA256
db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
-
SHA512
c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
SSDEEP
3072:v5sAzvcjE+lcO3zXgKRcP66BpwwB9RStc3Yfqr:v5jvc4+lcO3zQKSPfBJXv3YM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.vmfu48.win/DD08-8190-71F2-0073-1E7D
http://cerberhhyed5frqa.45tori.win/DD08-8190-71F2-0073-1E7D
http://cerberhhyed5frqa.fkr84i.win/DD08-8190-71F2-0073-1E7D
http://cerberhhyed5frqa.fkri48.win/DD08-8190-71F2-0073-1E7D
http://cerberhhyed5frqa.djre89.win/DD08-8190-71F2-0073-1E7D
http://cerberhhyed5frqa.onion/DD08-8190-71F2-0073-1E7D
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\sdchange.exe"C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\sdchange.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "sdchange.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\sdchange.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "sdchange.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5149df1fdca094242cf0974f8b4dce58b
SHA1d4cd18b8a58880ceba5324fb87ac9178588e13df
SHA256c1b7a6250765ee31feef8ee83c8587c9b597bef217a77565b776d6267658ef05
SHA512a6fb3b0d6d9ac727d16298bab7bf85af3e914b505112551d6d0aad939636995cc6714cd9832ebdd86c97d189a702157746a8c6bfa8c063033c5445e5fa28f4d0
-
Filesize
10KB
MD533d9e26b9211cac9e01bd37cb315e0c4
SHA1ec3b7ec4434ada7a61c269f42355f5c284c4ebd9
SHA256431eef1ed1b7737a521090f175b8ad0586d871a8e8183fc16a1066bbb0e6fc1c
SHA5121248469586f138b4587b94ef453d64cf109380ced2ecd2961947961b18ebf6d7990808faf226b1f476a4d82ce8248fec0414528c9b11a33bc0de163f57b32926
-
Filesize
85B
MD5dbd896aed2c37b57ef5729810b2f1c71
SHA1b219cdbad6566aaee4e046000a8add658098b910
SHA25604a1f3445a3e0b1e3a00164fd5db5fa63e0b93a41ad386f0cfa417378893a328
SHA512f9ff86155f35c67f6ef7f7ca8fef8a897b5bb2c74fe94fc0401764e083c94146ed404a6df4de7c8d6d1d11240635081bb8db1e2945a5f033da4cccd0d74ebe67
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5a1b5066c1c5f2e24bdd172d455981440
SHA1b5f464963cbacea6607d7dca0c76f5828ae8e124
SHA2564b21579a4de76d9dfd86789f1040642153a829cd7628a6c0de402f0a7d476ffc
SHA512e850f1aeeee29ceeb0c0c27d5ed4039941d034e45d639b9fb863cce8efa8e65d2f09c3a0c489891992d6803ebfe3992b91d096e5169c90e593e8c78dc6f933a3
-
Filesize
342B
MD57f80d0dda99c1c92bed9ec4f29050404
SHA19e6db6e08f17d5b34ba0f8554334b9044b13752c
SHA2564ae60f22b35ec101fe0cf26354b64f17ecd385bb37b773e2c67c5894efda2459
SHA5121722207a9cbbd5ec56a150a3f0c23cf8c2f5a9d37963b4d1290992243539ab04687d7c1039e2891da1c836bed4e13ec833e121bdb045e0913c57674d21181bb0
-
Filesize
342B
MD5f5d0d8892c41a8b503f05fd14b361c16
SHA183229a17bd8466c5c56de1c0f8b7b816bed38128
SHA2566812e476de3c793baa6c9861a0f9900e2172aedfaf47080fcf1180e6b70650f6
SHA512dc1be78b5312d9d59fdeb3fd6026c211fec2a37c22ac44a2b3c1e4b0c716cf291a71927b2eb653dce30906846fe3e92b8926dede725bb7fd353977f52e976f54
-
Filesize
342B
MD57177c7d54beffb7cb317d297953344f2
SHA1468ed592a73636fde1eec2019f7cb5031116bfeb
SHA256ade4706357d2a2a573efc003e654ee538f98de363f24c0835c511121c0fa5ba0
SHA512387801d467962e2238078c2c07465046c850643fc54cce75ee095bd2f9d7f5f28b6bebbc60d0d1013cd54923c3786f0959034a84e1cfc868ff74d2476bd7e08e
-
Filesize
342B
MD55e4dc8684c76daf570cc4507cc81d8b7
SHA17adeafb809b318a13b2596e3f97a893cb879514f
SHA2560e6bd8f83f503c270d894c621191e679c2f71378452830319d237ae2c3384620
SHA5124716d81fd675510cc8c2e4aac0554236a85b10d20be21ae6ce12ebb97cbde131e1f97549902ffe4ee3bee4bde285e4c2feebc26e0dea9d8a8c8b2990abbb1942
-
Filesize
342B
MD5f386b5b28f4e22d67ac63bb771be1de7
SHA1921062cb3e5519bc82d197073c73dfbf8dd44900
SHA2562a4ce1a2d0e114f2f1c1a77989ae35f3320bf0354194ddb8e10e1e8b634dd04d
SHA512ec4721358d9440701c6b8ebc49fc17b931482e35750d1975c39dddac28cc24fa41bc7c6bfcab1f2691067dd93b8028c92fb0f06f7e5a40439788b6f70f4fc3d2
-
Filesize
342B
MD54deb6ed2be2e60f2795260ad7faf2c75
SHA13358b113dba95f07a891a9279038c3d3fa6470c7
SHA2563a51c3b299b3946a257e32188409ee2205d06f344e87be87ad8f4cdbf6834012
SHA512ed89be106360416d2a34f99198ebc94a4e6f049e98fc78135eb84fa9ba29c2987e83539a5d1b613996e372dfa2c71dbf1922e521efb0f8c888a4d1ffb2e43394
-
Filesize
342B
MD50971335fa4d2ec5dc39c7c9f867da483
SHA1186eee0ea07a24498bf0a146fbdc2e57b462c588
SHA2569b9b44f5806f02228013d3c55b48b4209b018f715bfd6b944d3926adbfbba544
SHA512ee07dbbf1faedf258d144264bbb49a5a18291282cdb07d440541b795936070d64943a0e673d6a69a51de590f450a6c9cd75e850d01fc15badcb9d820d204c183
-
Filesize
342B
MD569d1625472a2899cf4f9cbcde409f3aa
SHA10ac88f0df54442f7966a2caaf433aa15288bf71a
SHA2567a4aa259893dd3f239c7dbc426f7c95608b41d57a0ae30461b822ecb3c66d8ca
SHA51295c70b91ac5ab64d1b12f84b8977d58da5ab12de956afab7bb6a41c18a052560b6254ee917258b700fe3bd9f64d43fc03ef6d9dfb8fb7f0db1b955810e41b7e4
-
Filesize
342B
MD576c921f22884884e73ef737ff69bc7c1
SHA1733a12d00a35949f6bbd576c88272603993bf1bc
SHA2563dfb04a84e6b310752dbc1d5990304d33ae43e8c5cd77830b9742470825de252
SHA51276e605f69e8dba41047b10e9dc40586c96fe63b40a9449c1d6bcef1e9e090805151958568a08d17bed8a50d660d625702a85b3259343bbc6fc52953dbab4c33c
-
Filesize
342B
MD5fb5b76e6606255adbde3cf0d69a59134
SHA1aa760c0775782ee6491dd10668cb02442a4bf7ff
SHA25605bf40ef1147d417a20fee058cad625e813b07f68d3f07ff88535eb98292c798
SHA5123eaf12dad46f807be615aa35ce82942518cb88aaf5e2bc2237f0771455f4f4ae1bed54af624d14f178e3fd988125ed65f9886aeea324988383b9ebd70736456b
-
Filesize
342B
MD50e3d2bb04e4b72c316f662ebfc809d3c
SHA157550402bd80e814d08c5180b5f0d0746c5fa66b
SHA2564ccd0ed3798850dd80d37744d845419c6b4ffcc086b300b6b99f7779fa34f573
SHA5124e3a609ba55e2f27ab01619c8ba01f8fc48ff943ed22e2426d8ad9242c1eec19f7eb238f43efde6c14cde7e40fbbdc475c9b8e264cd8d5273e8d46d68138ea08
-
Filesize
342B
MD5a8c0b3cec72217f7de6d16571d3f3f7d
SHA11ae6dc8aab9fb77d2ef1947c023d9c5fc34d62c1
SHA256ce6b529355e35b6963578991816a638e12c3e9f1b1a83c5e2f96ba46b3de462e
SHA512241f7c4398a242e5696cc6b264fd3126b734d5d8237df1afcf6ec6baaba139b3ed4dd17117da37735dd89f0cce3806f2a1ddc27725e2485a76118e5197cd6f06
-
Filesize
5KB
MD5d354db16bcbb9ed6a7789a7403f401e1
SHA16a31f2cb1daf2ff7426f1fdc8a5390812d7ceded
SHA2565f498bfef8c46be2bb517996b07bb97e83463e4204993fab1d44fbb722be62d9
SHA5128a47788b20f5192fe4a566e4e131bf04c3ecae86bf3b9640d9ffd327a39dfba02aefe8f7c61c2d1cbea88e69da9b190978cc9ce13e7ff1331e2f12387801c44e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5fde659380bb0065aef52c1327ab26a50
SHA1d7e26b044aa2460f9f808aee4c85af9e3e215fad
SHA256b335e7f209d20881b99cb66dae45c7ae16dcf4ed0d7d7e7755ab3984c0cfeee6
SHA512daf32531986cd3682667e9cb89e47be1535bb89449cbdf3cc4eee27353b1420cf0c1dde1c04f7df0d9560a1288e3b32844fc1818093c48a752a6aa06cc5eb3c9
-
Filesize
344KB
MD5270b70bad151a515136f553e5bc880ac
SHA177b7def336c7647c6faadaf7136d70ff1e9ba7fc
SHA256db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
SHA512c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
120KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB