Analysis
-
max time kernel
126s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
02-06-2024 13:33
General
-
Target
VirusShare_270b70bad151a515136f553e5bc880ac.exe
-
Size
344KB
-
MD5
270b70bad151a515136f553e5bc880ac
-
SHA1
77b7def336c7647c6faadaf7136d70ff1e9ba7fc
-
SHA256
db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
-
SHA512
c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
SSDEEP
3072:v5sAzvcjE+lcO3zXgKRcP66BpwwB9RStc3Yfqr:v5jvc4+lcO3zQKSPfBJXv3YM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.vmfu48.win/8572-1CB9-2565-0073-14DE
http://cerberhhyed5frqa.45tori.win/8572-1CB9-2565-0073-14DE
http://cerberhhyed5frqa.fkr84i.win/8572-1CB9-2565-0073-14DE
http://cerberhhyed5frqa.fkri48.win/8572-1CB9-2565-0073-14DE
http://cerberhhyed5frqa.djre89.win/8572-1CB9-2565-0073-14DE
http://cerberhhyed5frqa.onion/8572-1CB9-2565-0073-14DE
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{D829B335-8529-7C36-6396-4FE23232B17C}\TapiUnattend.exe"C:\Users\Admin\AppData\Roaming\{D829B335-8529-7C36-6396-4FE23232B17C}\TapiUnattend.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275458 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "TapiUnattend.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{D829B335-8529-7C36-6396-4FE23232B17C}\TapiUnattend.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "TapiUnattend.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5c50b79fd595a3bde92e9dac7506f2aa5
SHA1b7b04349e5f1db6a5fb4f2f083d7b5be01d6c12a
SHA256c28ff981e27e6fe5b9acdef4edb2d1d0edeabc3b8b6f3d715dfd8e3d03ebdbd6
SHA512e7fbb748c1ef7eaac7f4dd91a68b549f3d4037c1827c70f58a394cea81544714e1dff89bb9983b195bcadd5ff9eb190ec3a0f2ceef14d9cd416c721727bf9236
-
Filesize
10KB
MD52cbd98c8993bf70846f95b63cc277527
SHA1feaaaeffdb9c06d29ca3c5b490f0ed5eed838120
SHA256f280f05a9ce5df3ba4af35b46a1a9b6029f020a976db265bee56d896c36384ac
SHA512db8e2815462daf614bfd8f310962d00c19284c7e70441e5f38a4dcd1807d7fe01ab81e9dd047a1a4b65ce72ab05a72b4ba743ea98b70450c1b6db90282104b69
-
Filesize
85B
MD5e40017dc7d99eb7a16860166184c8677
SHA12b1b12ce0a93b9f0cae5cf9fb39e984b5cf63152
SHA256986df76c639a4b9306bdb2b9fd35c822b34a2bbec836fce56289a3ae71b8aeba
SHA512d1e85a25af9441fdfbf9dcef5960ef32ef6234df433afdae4cb41dbc9482a846575b4162a5c6f498c5170bb9fcd206061a9eb414cded68b21834e277eedcb63a
-
Filesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD58e7ec113587ae21bacbed70d7faffa07
SHA1a88d71a3d55f9b29172f97377fd89af1f78f8687
SHA256909362f53ce1988089736eba0cac0b954cdb9b0c7454292e9b5c463245d19eb1
SHA512359e23d0200f17598239ef64c1227879d67a1cad1d644395f65bdfe0152d08be6271cada3d5132eb8e0a174f241c48861d955a9370ae005d5982d52f49e5150b
-
Filesize
342B
MD54b9ad4325c06706549d73bc8c456e70c
SHA17b2ef417ecd09f12db590b2b7137cb7ea688fa6d
SHA25645f9f37e2a572c3532a11e6a485ce726e596839ed570f47211f481538583dc6c
SHA5120abccecf8cb226f2c8d5e266453f84c8021d349f9f64bf13e37d67648ad1a455875464a523bd4a69c6d61f6c80f3ae4f8e7305cee82393c984e3aa77ed107a53
-
Filesize
342B
MD50bb6287b5a7c7531f8b4b0410fd8bc13
SHA14e877f894db6b15b657337f7c89f323dacc719f0
SHA2564c8e93d30b24742b0ee3a0b422182e56f7275d8ab10b5b364ad37b1ed057e3e5
SHA51233e3979ea8fd7e96067fd5da6fe349e5449255aa714ed5a1c5d145e4eda35a455cffc4f5e3cae04aae346d3cf94d6b597b1c5c2035718c74e0d98c035dcdb900
-
Filesize
342B
MD514632735ed05317a6b244d4ac43fb320
SHA1f71a82d1da59bf8b318cb01011be59bfb42276ad
SHA256ad159c3cdd66d6ce664f3f8ccb94ed14fd652786333d0fc0e691925b870b2967
SHA512f399f626a0e22039a4697d193f5abd2a25b487cb5f54a1f591466d95f45b2983aad9d258ee9430ecd901b63d96815e5040b67eb3f5c68b232ef04d07c5af90c9
-
Filesize
342B
MD5ae44ce766d5cf9db04a23e4320bc878e
SHA115b0e031417458780d5364cfbe244505e1b99b47
SHA2565bf443343debe5a039ac3d85464f25ffa7d21c87d7fb99dc01d7e1e2b6b527b0
SHA5123599413f6eb54b4286fd10aeb951aad6041ee269aa40be31a3a1215171c3cc334d64c6e0392f605956f22750c20e72aaf6232144968b3924291f59f91d043041
-
Filesize
342B
MD5f228a27822c3d71af3c591a214f28b53
SHA1fd3878f18be2bc57be9b8f8dd709a849e14d4584
SHA256d43b33e822b112f8d7a93e3b074ced2def57251e4cd94b5544d2639af4fc1856
SHA5122dd65d647eacb62c41526013eb9dc9ee8721fcbc2c71dadeee4e5cb5a2d867dabd79dc1121aee7d59c51a114c6e7f1110ca1924a25301350c1fca79232be1c05
-
Filesize
342B
MD5f4a92d5ec6c7cdfc3d973ca89f73c899
SHA12a833187fcf3c9cff6ce9e87d6869baf1520240a
SHA2568edb97f3091ac7e216f90b71b8c2853ba5d7f4e5847e63073d21308d5a69eee4
SHA512bbb3e183f9082a8c04181643e282a319cd321818482fe2fc25d4feb5abd955f68d056b5925bcd24956c67ccf919cae10770298ee401830dcafd36d1800354158
-
Filesize
342B
MD5f88bebac20dba30515df8af5d48c8eca
SHA11b511d01a9fb9ef1ef03248c48ae2128c20a9365
SHA256b2bbfb94999f6e38b5084e0bdacf4dede21a65874c876fc3b1f0d4e1f55fe228
SHA512b7cdae2efe470c4c07cf7ed1daebfd36f2683dff48143caa1f0aa76317a93a7142175e942125abc33ad0b3fc961dc394e55764178fd5daa7edf21a1b6922f313
-
Filesize
342B
MD523c64f825ad737f042bf565923727777
SHA17c67e194af5e7517462b5c96f0e1b1248df9144a
SHA256c0aee5f4753616cbcf07e50fb7d3cbd23d08b8a7e99f22823bac6022eb6ed649
SHA5127648e31642092ef165efc2fd19a8d897015db807c3c7402257da2729ce808565ab6ed2bc434d88eef34c025e7a5d1517e57ba63a2a0361071df09df848b333fe
-
Filesize
342B
MD5c32873b0eb394a5b3dfb611ea401c72b
SHA18fe77675545de7827a4aca27c119cdfd0a0dec3c
SHA2569d7586b947dd5abe722c5731f9187330d921d20aea2078e0ff70fb24eeddafdf
SHA5123b24690486f47783f94458906ef3a4b39151d60f33d0e8e31eb2a1d18afae78c1aabde42035c2a74246f0ff88bda94676851db1731dfa5d8e072eec851a8aa47
-
Filesize
342B
MD57c489b9c9ff0d9cc4f39ae59f31a13db
SHA1e55d182bd654258d0f521c04cead4960f27a0363
SHA256daaaa585a1726d7c5ac06810a92c926a95b3ea37b70ce85ad59e9595955f41a7
SHA512a65911deaec6e5387352a45754d75ea3d1e836056d2d7606e1d3c43f0162c8d58a45249c58b7c6becfee675e0dd68ddaf0cfd941273ea9947285cbb56b24569b
-
Filesize
342B
MD537bf466fd726c8d9709a8588319705f1
SHA1ac7a0e3eb42427d686ae9ea3f4d1e258581453e3
SHA256dc5bb59776f7fd48ad8588defeb14d24a83bd7f83954f2ca72127b6b63690ce0
SHA512e71fe53ac18df8e7c3455f2d59c634c01c1916f815824897f5d5cf87f6b077c8426a475d6496c7f893f2cb5e28ab474fb0bb8f01d9eae9bb36a2621bad5b93a6
-
Filesize
342B
MD5feee607fec122608234eab975f130389
SHA142120cc53d5853197a36cc92a410bcaae1aa5c24
SHA256619ebf3ff8b692c963576d76cc97165e3b6f60212882d6b20828b9d1e7476cd2
SHA512945abe5db3bc1a04bf805397d311d67cab4663f15cff400e662246fe0cf181505a5f400b7a5714a9ec655e3358f4185c142eaccb75bdd78fe89e65a17cf9da62
-
Filesize
342B
MD5fe007faff6f24d3ac5075aeca87194c1
SHA119447ecca76aefc2523d73f2330b5405308a9892
SHA25614ad55c7657df460c6032286d073a706c76f574d641f670349aa558ec95a0215
SHA512b146f3a7b034abd0f31665476cd5990a322e6eab2e868aa905561a0abbe80015617e489a4d0b20b801f772f87586fddb69a5d988b76f9f0b48ba146120221d78
-
Filesize
342B
MD5792aee57909b0ed568ef0bee59b7ec30
SHA10fae54bf913e15f50e848caf83d0070e0688bced
SHA25664281fe2192d0b5be1fe396054b97116006be6d69fb2546f799f2c5c24d13c5b
SHA51290f268f31f5749da20a1cefd2e523a216da7aded9ef55294cb87d322005e2533ac8c0657e33ceadf477e133c5fd9376a0ff1a1b4c07511929c518ccf3818eeb6
-
Filesize
342B
MD5eee99d570fcf353ece42cc1b38f58fa5
SHA142d7dfcb646bef3f1b2f211fd221288ea8daf9a9
SHA256c2256976a143656249daf10bee1c852fa37f969991342ec8a9a4e2c1e66f95a3
SHA51237b80705cd5808184a04899d7127f5766bdc804fdd96cfe9cd9352b3ba23ad825fbb67204b8f481ff8cb0d842a86cbe5c0024b03950cb0e02a29b84295b6f587
-
Filesize
342B
MD56627e16a027cb6715aa1c6678c7c957b
SHA18caea10b083a6c815b5f01a9b42f1de3408f3e57
SHA2560113658d0e6620458cd7939374f74abe5ddfc3044ed78f0025a3dfd6bacdd870
SHA51214b99777c38fb75f6659953fafa3eae0a392ee88112ecd63b030069056659b8fcb594f102815283e26510d4182b5bae79de2c7538110a0c470bbf737c4bb6211
-
Filesize
342B
MD557937083e08d4b72504f48f51d104c65
SHA1180da5764879c66de6d7b76bb8375e37ef6b0205
SHA256200ed02a7d38b972701c062e4b6568a13a0364561e1a678dba24d12ade800e38
SHA512893d4dd9039d1db20b3848a68ff92555e39bdfbeacb21990f1b6dff9c22bd462a7892b6a67237a3a13c44f717b33746095e61d40078db8996856561a1c661f7e
-
Filesize
342B
MD5ac9723f0a6da1084199b971fe50588c0
SHA1ffc5fdc5ffd6814eecf7a0e74378cb2253257363
SHA25605b3f5485972b7510bf1402a5ecf308893cb18686d293c885cf2c36614ff0544
SHA512dd55e724e283b72d0f541cafae8243892dba9afd3cfd8cfe3b7de342a2c82a1bdeee3754c0b478249825d148d5410d2f0876b2a0f3e93d573c4613cefdebce03
-
Filesize
5KB
MD55ac3ee5231cd880ae306d79ffb954ed5
SHA158a3403cf5f5833a10320fd03788c6098b225095
SHA256151bc2b3c774dc705ed508fba2999b367546b2033f57e58d0090166c4030ccfd
SHA51277907746c11abbc1d2f43bc0fb8d98d0b41efd38e388f9795777660e262483cd657141c4a7094f1bf9bbd1a882620dc32a8952421ce13fa091cfaf6ef38f156f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD52f8bca94ea4f59133b47f8767ad7689b
SHA165184055879df101bd9caca1750b62e030306c19
SHA25686784edfe7e85bf00100d5f88abc8e585212c3723b40653d92d9d8876b87b757
SHA512a2dedff168c07cb9c73f91db8380d16da3e311bd10256d5a3409cc05526ede95e5c2355b847e421de89623a6c4331b9f74be3769a71b1a6e5b2e7aa7f12bb265
-
Filesize
344KB
MD5270b70bad151a515136f553e5bc880ac
SHA177b7def336c7647c6faadaf7136d70ff1e9ba7fc
SHA256db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
SHA512c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
356KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
356KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
120KB
-
Filesize
128KB
-
Filesize
128KB