Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
02-06-2024 13:33
General
-
Target
VirusShare_41dd108ada487cb93a6e099e074f605b.exe
-
Size
382KB
-
MD5
41dd108ada487cb93a6e099e074f605b
-
SHA1
354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf
-
SHA256
aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3
-
SHA512
33adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b
-
SSDEEP
6144:n0Ly6qr9+br6u1yvZgQHhEaBTuPwyQ9Hmdy1MsZ:nxF9FZhH+aBaPUGY1M+
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://4kqd3hmqgptupi3p.wins4n.win/6857-0654-2A6A-0078-109A
http://4kqd3hmqgptupi3p.we34re.top/6857-0654-2A6A-0078-109A
http://4kqd3hmqgptupi3p.5kti58.top/6857-0654-2A6A-0078-109A
http://4kqd3hmqgptupi3p.vmckfi.top/6857-0654-2A6A-0078-109A
http://4kqd3hmqgptupi3p.onion.to/6857-0654-2A6A-0078-109A
http://4kqd3hmqgptupi3p.onion/6857-0654-2A6A-0078-109A
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\eventcreate.exe"C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\eventcreate.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:406530 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "eventcreate.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\eventcreate.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "eventcreate.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_41dd108ada487cb93a6e099e074f605b.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_41dd108ada487cb93a6e099e074f605b.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_41dd108ada487cb93a6e099e074f605b.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D4866ADF-6D8B-4B07-9AC1-4309C3340631} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\eventcreate.exeC:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\eventcreate.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5074ae8d5087ae6f5afa8b0f5a30712eb
SHA1db98d8437ebfc0dbef18c06ab9204ddf868215f8
SHA2560e7d96d0af7b6296868105f34279f53909b8c26ef229b6d2209658f157ebe357
SHA51241b1ee0c2fba32cad5bd4064f93bdd8affadbcc9054e07d0cf84272ab1d1044f6c03a2e4ecc6f850d848e73206b70f608c2d42b9a3effdd5e746e270640d14f6
-
Filesize
10KB
MD539e93c805f6040d56b004d6453bbc076
SHA141bf68b69e25f2fdab39959d3aa7819752f4d1a1
SHA25684ee1ac8d692f7b74c6b5171750efd188695e367d24d651e3f101e7ccad0411e
SHA512e7b588fbff0b3eb2234ce9a3e96c3fc1e50454215e90b712505e0c8474c3ace0af5f3384221c4505620abaaabff3c994f0d59039e9ab4f03a1022f3f7fd6c860
-
Filesize
85B
MD5bc20fce745f4497b67152a1348b4b2c4
SHA12605bd148375b7cf5f691750055ad7e291ede7e0
SHA2563e6acf420f948be55bee0f1cdff48fe0ea741dfea05c2adf1ade9c0a553a92e8
SHA512d2b955b615628eceff8b923f4230b09b7b245897b778a877029fd5976587f193c40fcd0d7a4568cf49a121fcd42b57b95a0247e52bcae9f0dbf73c747ada695e
-
Filesize
231B
MD59d8c4bfbd009c4d6001e2125abaa8b02
SHA1cd040558172b5fca5b200447a281843956243741
SHA256a652297987f14317100f8c5f7eb26d1bc67eb8a64f0b39b72b5fd5046a9f29b0
SHA512c4c84f43642b805a105acce9ebc9f01aa0e6ef553ea32be3f8b890fc7440f0b7d3ddf99b9336bce20ce7a3d9b9f6434a704651a8af425ffc8407ba39d5de735f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD561a66aac59fac75c8cff4c9299399b3d
SHA1b7f0e2acb737901b3860d8a7cf1623e23fcf6830
SHA2564b08844e78b2f1bddc3ccc71022f96ee6ca21ad2273aea46924bc457673e5afd
SHA512b7b6b699d127743cd9b415adba9f941358ad1ef5dc59d112a98d6f5ef2e14d00240ca06bba036eb20ef2d1b5895f18de0943528f92b5cb89372820101dfc86a3
-
Filesize
342B
MD53afb27e0f3a6d80cd013ebd2dc753010
SHA1cbb183e6d4244f6fbcce317dc94e4e1f9c78cf4c
SHA256a47175a34b407d1b62f68461df4705ad2cb82ab5c5d7c6639457c8758903d6a5
SHA512414c78ff0a6f81256ed607544a3926375877888f2a569ec8e14db530761c3d5562526b36dd5c02f19c2938de8d4d31b02007bd930dd77045096d038b4fcd8ff0
-
Filesize
342B
MD53512cf3458f7acadcd49a25194e72795
SHA1da022bb7fcfde3f979eddc8754a2dac653b0cdc9
SHA2561412ec7c24e7e78530ac9f966a39ecddc88f87640675430e50bd1625bbdfd81b
SHA512cddcacfd74d1fc17523210f1ffed2d474eaffc4e195d90b119aa82a68fc8517d7ed0d63150853a83efdcd04077de58756d302f3389b78a8b50cef306a8e4be0c
-
Filesize
342B
MD5d024321929393fae178f9edf3fe48c3e
SHA10b9f8d721a03a61966cff4e61a5db6fef59e6efd
SHA25685dc309df665c04e70d5209eccfbbbfd8e009b684ccc66507bb81b8a0b9f746f
SHA512618c60f089ffe92a25a2d85bb73cf4ce433056108ae31fc9db31e29516a098f1cb64e2cbb424495c11861e5936025e630f2cb8289529b6a3c4f3592a5be9e549
-
Filesize
342B
MD510d54c2ecd5b9763a436ee01608707f1
SHA149f013c39b6183d0b5decdbe62d2143b28065728
SHA256686e54013f015a181ba7b7860f6184044ef96e27e55a32b47a07dde0a3661bf0
SHA5128de3ef1bc968f961d3d6b05ae75ffb46594601ab365656fd2239f25a21896a24103cdd0675130d33380d47da17b5609cf5fd2ffe1a76792abe6b6ab932d3be70
-
Filesize
342B
MD57c186b10df4ab10cf34edbc02ab16a3e
SHA1eb14e3843a0b97289a872df6eeafac5ac97e35d1
SHA256e67e0354f832a8f87449d40f345ccb843e1cbe63498b216a88bede5aff38da7a
SHA5126f2c2c7e0061ffd507f92d1ca730adc230577aeaab7e3af03237000c33e6a3e9c8c013dc04eeaadde46167b0672cede753e066d8e0d267601fb1941d032a2f50
-
Filesize
342B
MD5b010cb806c447e6b51ce86e103091f6c
SHA1409500c9e9e86d0fcc98efb2fa686944efeb47be
SHA256c21867820c69185855489aa8b755d7b6223c5f8a30005398cf0eb9919f5754ae
SHA5129873677cbc9ab9a19137fba09d2b92476c64bce42b3aaaaaa4583b9e904a978732bfbda2f3f60e89fa65b2991b1757b93f29de52fe1698620bf652fd1dd28db9
-
Filesize
342B
MD50cc0e0e0d77a667d0136f7c804a57875
SHA11bd7e26d5f3b35425c778a632789c28adff07589
SHA256b70a21041e16e4816d1682d395ad7191cc3a7fc216c29de4dd690038d09b95ff
SHA512216258d993d1b52ee609206889f1ba365b3abad82013b402a4ef28767419de248dd5c1ea4961cd664b283aa3d266af4b9a77ade0546292d0b04a688443e06289
-
Filesize
342B
MD5984bbaeadce7c10d6b228df2ffd29bd6
SHA1ad4b06d3a5c995bd8c91bcae1de8af963e100c9f
SHA2569593a759be21564b0f745003ea702b1de9bc24e8679cd281d06d57659b94ac29
SHA512baf6ffc17d33df6c423a7a5a912cda8c3f2b2c052cc546f4511fd2056d173e0e33a964c2efe8887f8b8932a3a82a578e017684457f07cef9547ac842f8aa0322
-
Filesize
342B
MD5fea9d147a6f9c60f1b0afda8729cb9b5
SHA17d3e77b4aef4dfac20e42e06b945fa6f0b917097
SHA2560389482264d2cfc063dd41f5d403a5f3bcf19e58868f6ad7c4c4fc3169be0fba
SHA5124ccd9b4c9636527b1a9898fffcf2edfd5b03cf0d2ed90f1d88a7981ebfadd200bbec3e2b1b4f0d792273493e84735ef9c28e4208f67cf6e41a01e0a86a05b438
-
Filesize
342B
MD553d2df7c7474a3a33e8c4883091a87b4
SHA15e7fe03aca37e0028a8a10bc0e8bd40c93600c34
SHA2563d79a171eef26092986f6d47eea897376b71febf455fdb2f8e03f2ab7291dbd8
SHA512717ad0372c72b25eca6711ec02fbeb1227a2f8bc8d94664d10beb2760d0590bb370920c51190d784b65810114b6ec128208ae7dbb43a7820a1049d7741211085
-
Filesize
342B
MD5e684a980936f336be2faef2a555f0de0
SHA1490c26e9b21f302e38c5c8192fe247ad22216c87
SHA256c6f3d8fa0f32d9678d8403461d712baa7e105911d2bc0eafef72878ce3c6642c
SHA5128b54719c2d951c2e70e734000fb1ace9cd85dc26b5355cf53cf20bd16ffc176c84013ece541f205e7b94011b07204ec9fd855007e2ebeec1e68d21a9779934f9
-
Filesize
342B
MD50698d02c8ff9228c8ba38c391a79d424
SHA1e7af6800517f165a1cbc161de8aa855425fa4d12
SHA2566a7ff9cffcc05ebae4bc358e95772f10e4b496a5255274f3b78b32ab4eaa8164
SHA512d11c9e814d733f416f5b85fff26b31789f5ab474fbef381e8bbbf6549c2d89a0944f2b160f309e126209c1871ad9549da895c0d8145a9577fdd2f740a863ab6b
-
Filesize
342B
MD5fd652800a86672f67a0ce38425ba0817
SHA15f7a7ea59ebbe8d06607e89fcd0d0283c7fc964b
SHA256d5aede0db7862493ed2dd4fce5b860dee07a29744e33e10b70d5a693bba7e131
SHA512283f0a3deec4320fe163ea28f8671e6e43ec694945fa4e107f9a435dd2235c18043459223b6b25fcc7d4d40a390e7edb97b0a1fb05973d6ab333bc7167aacec0
-
Filesize
342B
MD590eb916c672e4b5c46bb61e2c22aaa81
SHA174c210e8f41181645073a034878c262036e9effd
SHA256a3fda5dc66e60c7b9696b7f275c90b79aa7d2297afd30f60bf9ab4b97dd8e08f
SHA512b325f1bc8d82cb9558f8b73a8884edd72d07b6a0b8c156195ca477a1eda9f7e9c4e2929df3369e25c25b8254a02b39357998b2410fc6f890d24635de17fc670b
-
Filesize
342B
MD54776e197f16d3bc2026aa294e05fcda7
SHA1ece8fcc65e7baac10240f4b3c5ef931cf8a69cce
SHA256170ac84618a73c39525f96e8a30842bc7488c35eef09ae5d9472e7797ded685b
SHA512933cd2fa67ca098afe76744f89fe9199813b1d889756b34354de43236b8c17b1aa189ee753f802a41cb1890029149d3d320b069dc75fe3ab4790bfd1c3e98c9e
-
Filesize
342B
MD5d7b78937365b1da929ae4845794df073
SHA1cc7f2cf18145c5dbbb87f2959813eae10fccc3df
SHA25629e47d321a4356e39fb4db01da7f88ea4aa280a59b224e3a473b4153ec8d00a8
SHA512747f4ac3ac21e5c817af84ebeb62513988f55b900a81f5e6d53df9117b60f5d0495b1157a9640e8afea3c77aad9bfea39ad5243125faa82aa9b724197d2d4bd1
-
Filesize
5KB
MD5926fbd8be0e1957a85b685a5719efc69
SHA1feb761a6f1694c185b17b6ee5b9f8272b567dd79
SHA256e1f96d379a690ef540d90237ab740900e4d3e6e17ab722df82136862a453fe2c
SHA512cc371270466c977cf7a1bf9558c47e69c5b6711e01d9f1cff857b5e134739bfef3584250871343ef9da9754af587d30ea079fecf1cd0e8cc0b1d58b040668c2e
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD577c1664060e9f616806b58d7d8cca8ac
SHA1de03b8e9949f44c7e18ba3e799b51bd1bb46965b
SHA2569c89d62afc4153b6eda40e168b4e671ab49396a3d06a2519cca5ec200486755b
SHA51280d401ffc8d872fbd437411e975b2e7e165461ff3642bdb0cb533ac7aa32bbb004d23a1cb5062e49d0ea37c198ef78d042c394d4da0dde4a1db2818b18de8db1
-
Filesize
382KB
MD541dd108ada487cb93a6e099e074f605b
SHA1354f9fcee3214078d2bc5e3ea55c6b678c2fe2bf
SHA256aebce4939ad8d8df9d1807debb140669e47a24c71b7978249362d3b0900c33f3
SHA51233adb352e06e779871224ce094954756f15e49785fc14f8c8a02476b420b00907961d3489944c2da42fa84e8185f0f6bc7eefde58ebc4ae213fed9bfa1b5932b
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB