Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
02-06-2024 14:53
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\# DECRYPT MY FILES #.html
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/1F1F-F8F1-781E-029E-D4E1
http://cerberhhyed5frqa.qor499.top/1F1F-F8F1-781E-029E-D4E1
http://cerberhhyed5frqa.gkfit9.win/1F1F-F8F1-781E-029E-D4E1
http://cerberhhyed5frqa.305iot.win/1F1F-F8F1-781E-029E-D4E1
http://cerberhhyed5frqa.dkrti5.win/1F1F-F8F1-781E-029E-D4E1
http://cerberhhyed5frqa.onion/1F1F-F8F1-781E-029E-D4E1
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of UnmapMainImage 4 IoCs
-
Suspicious use of WriteProcessMemory 58 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exe"C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "wecutil.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "wecutil.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {8EC44120-6E78-442C-BE10-3A61423F9D2A} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exeC:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exeC:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\wecutil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD55888f000a41f89424c104b357ddecdc0
SHA167a942f77ad96d81107567d2be22441ee4337591
SHA2563cff79f5bfeaec8b16495e7c52327c2964d20b98a7d2da125b99b1663911d19e
SHA512e4b6abd53e7c3697f3fc1dd5f8938277ff6fcebaec24853dd8d2065a1a0726a346d2d7c7342864eb13b557f31466c7eee55848e92fd157e980968c852790e507
-
Filesize
85B
MD54d958a318de740d7b9d811d426b123ed
SHA1530d5ca893f2f2b21908a77821d067d90bba1eb6
SHA2560b99395d8744ad4dd08a216df60d9c1e0f78c2f91ae9597e237ffdfd256b9a80
SHA512b6241a883b51820f76e552f4781614b399d7f3a761605aa5545ab9c8ef8b17bebc3ea13af09e062bfeef164eb940ac92fe294caa8ed24031b8a5bed8744aeb1e
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
12KB
MD565bf8baba5ea8f417323465fbcfdc86d
SHA146ebd3550a64c33454b581a6e074a32abf45c7cb
SHA256c5bac8be907105171e58c31602fc49668f46079d5553d9cb0ed6939d792767f4
SHA5127ac67f43663cb1b522de9d83277f2385570eb30d4bd00df5ea5b7e760b3d414847214a8110a5aec3d6545f786d5196e9074cb7936bef7abc859574534d177abe
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5a28dc25b47a1a82cfddbffb387aee814
SHA134a8da82591aaff25cc811913c0a678b4f352554
SHA25632438cd137e37c10014ba4c745a8ec30753ce99c2b83d0540e2e4fdbfbf5ec80
SHA5123f9e02227f9350e688bc74a2547b3307b8282181521eb84bdb21feb99a58128c3fcab7e3fb77f63364d51347f080e50bfe33df5e086f0c85eaf4c1dea411632f
-
Filesize
342B
MD5fa1b439d895e1447313ae6e07ee4d5d1
SHA1ac6393bf634782e5d454e2c985816a6fd74a27be
SHA256fc38dbde4f46f65611d0c584cf52b1b0add3ac52032b14a4dc59043b64ad6db8
SHA512cb1dbbd2a25f06ec619ee598a46851e1975217ea486b22bc1bc73d6abedd66f144df3dcd67dd43593736965959b10be10fab9995b1970cd1854bdb707a1d9013
-
Filesize
342B
MD50b07e17e0e9c104aa66037584b59b913
SHA1274357d0fde5f42dc936b0566fb9b75435cee800
SHA256552b1471fd5f5c195c286d83f950c361a64b04de0a10ecef7a29ce15c97c57c7
SHA512adbdcca6ae20914a83aba41327c2a556c5e2beb23ef2e778f8a31347fa54a7a0d569ebd52706b50d5d8b0cee20bb08eb1c4126ab2403b16224c68ccb62f4e75b
-
Filesize
342B
MD502b6486789094e42d8d1795d01f38935
SHA1e966da9f07c31fbb3e9e23a4b78d35f9d0ef5407
SHA2567aed3c3adc28a3bed738bb034901a8ad2f8f1d8e5123222018dbf7d68fd19406
SHA512c562f06fc7c561c25a8c02ac40c69f8db2a3db01be251d4a42e4bc23346ed8695e0057f552dad7202e518c9eb1a5ac57ba11f7da499a2c35f14f4e6f078f53e9
-
Filesize
342B
MD5b5ed1746cdc1d3521112475f546b9639
SHA113cc572f7e96cc6265c28d0931524990c513457f
SHA256477b8e7f236a9960e94797ce0ad5090e5abb1f9eac771c38e2f0c0126a4b4670
SHA512a223f82c74b1fb3645de546d94538fb0e2d7b2fb75ca21fd4b71c1bc458e868c2c4b95c596dc3be19b0b2ab7ea438dd1b35ad1826d460b30b9a6d91dd73a4964
-
Filesize
342B
MD590036d6d3560f98a2ba99d401efad727
SHA198e466c3f029473af6f5759fddc30da5ab1dc85e
SHA25610872118c7fa7fde841ed27df77cd5c295216a35129391b97e94576a6620b405
SHA51286c7d8ad34f069e5cab3c0c21066420f37b083f88ed03c3bd3aa4297347bc978a7a3f59e5513e4a3a801d8eeac3a3c338e2a3134e898585e674d12ff7065a486
-
Filesize
342B
MD56f8bcd7f6cc805759192433cd5878b5f
SHA110d9700a67606d94bf83a6d3924d87e65aa11f8b
SHA25666e09c0a02dc688a8c5458e6afa9b79cd82107f44d8548edb82be667e5d70926
SHA512cea1eb047e3164bfe2791db116df13f2548dd92a702dd31a13ec747985b06460a8497908b6d8370b6b58977c932606123e3fed60ab4fa55745a9455a5a8cefbc
-
Filesize
342B
MD543e93603fccf87ee00e8a0fcd6c51a36
SHA169ae66a58dc83a18db5858b882e9f426bbf330d9
SHA2560851e71f915acb90cccefd42bbf57a0b9ca1aef6094ab67b06afa9fa3d60e604
SHA512ca46ccbad926a218749c4f226763fcbfada0930c8f3ce18e44037b3e2ab98549398441d0f5063e2487a90cb84b0ce39a86e335b2dac240e4ecaefe547269a602
-
Filesize
342B
MD504da6c5880744269b25973ffb9233143
SHA16caf3729e70401332f93d7e47ecd22161adc06fe
SHA25617ff23ba5d05c1a83caae8cfde4424946bc94f0b46e9024f09febe690ad13637
SHA51295e87bb809673e3f2bada2ad892127462a2f6c24f03f0ab7c26391c17a087767fd828b917fd6e5472e69dc11d1f1684f0215f8ab9c1bd4415838f85153f23df3
-
Filesize
342B
MD5b797c37f0eef0f52affc2ec96b823951
SHA12138584fff5846a47c042bd71c1dc981c4c65650
SHA256368e9cad9575708919a562e3a5f2802ecad6b5f5fa0ebb2b307da91dac989ffd
SHA51296fab155b638d1fa292415a15221d96f5e7c7fdd0a78239ee01a403ef162cd5dcbe420be0b0684dbb30da08c62ec02614b0bebbd095f00591dd0d6e201a9473f
-
Filesize
342B
MD54e7cb5fe27912acad2d069b6eda0eba7
SHA1e611cfcda0529c34b8066b1dbcd40a14497d6744
SHA25685f895357371a0512e614ddf6a01d01c441f5162ef981b914015b9b4d4a08610
SHA512034b66d7136a3ddd9ea33102e229f4372cb544b42b9e551255bf55972bdec3c4781acd5a63e7789611719f814b3621ea952db629987ce3f33e52fb95ee7270fa
-
Filesize
342B
MD5eb4c6d770977d97518179d3575c929a9
SHA199ecc85701c3b2f80716d6db0764ec8e83ab6b02
SHA256bc243ddcec063e9235549be8d947bf3239c195e7aa9e69f1d5a734e084a347ba
SHA5123afe2678d24ecc04bc85e8867a30db0080d2367c823e64e3f5578c71587ec6daab6edec6b6453cd2ca77204aac94123ce153983d473d07e0e7e3b0f43dfa6884
-
Filesize
342B
MD5da4be0dc0a8c93383b90c6e114a67a90
SHA136cab9181d453e7d95904e04937d3739ba251cb4
SHA25639b20532d084c0585fe1b289225ae6e397fab04b21e4eafa0e9a79c7443113dd
SHA5121b01238adf8b226ba84f0a192bd9a5902447719cbe9d33af212cc580b26739a662ae7c0c8f4bcd861f2a39a51360d875a4182eed025545df9ce9e280e863ff36
-
Filesize
342B
MD54d2f5f5df2d209e69dc3771deebc9d5d
SHA1cd32679c07131f323ccd422853e3dd98339439a7
SHA256cbca2860fda8fcb10202b49e8102be9849676bb52c8d2894fd8e23980e2e6df3
SHA512c466334a3f6d772c8252ffee9ca577a58b1b2adbdb9e4a02c0e4ff52d1eee8675fcc0dbbb2757a35bd0866436c719c5a11cd1bf7598bdc4c7622a18f603734b5
-
Filesize
342B
MD54b234271d6dba937831d09fb452d5f5e
SHA1e82984204c958cdfc4f66650909c12688b40748f
SHA25618d55bfc2b3064109d3ddfd9647b62b9a7526e4a0c4041614b3345d1cde5368a
SHA512004b405d77966096d2fba8466b1cdf0c6c9d258ecf6dea2908305ae1daa94ea015c0b8b97eb931798f84afb8871d84f74bef0412755c4de1d9eb3d01948c3f39
-
Filesize
342B
MD56e5dcc9568f33ac4af2d47cb939de69d
SHA1752e1aca1691f0b23e2aca5908efe330139bb0ca
SHA2566a06b4d8dc4532417a28bb6358ea2a903534c650c8274b20c162bd85033cacd0
SHA51226701aab5c31a571892daf608729ba399409b29970affa2a488828d7027dc0d93a417318a682f001b1ad77dfbd881b1841f57c415f110e32d1e4b220ba2ffa6a
-
Filesize
342B
MD5d197098d655e22aff517b066ddec456f
SHA1755173db6cf59d6ffe35c1f07b6c717e31d256da
SHA256ab8da32443ae1eeb7cf1924d948600670c270019f3438dfa4b5e1184a16d9d79
SHA5120aa77d21cb4d79035aeb158abd28bac326dac59ee6aac109af63d54a04149244913815966018f4fb44a0b84d99bd3a0faa25b5cfdb92c0fd8644ffc1e2d8dc69
-
Filesize
342B
MD526669d6cb75671566f6f3e793b7c18aa
SHA15e598fc56a444d6cb69b89369c7939ea13ad6289
SHA256921f28619c977cdca7d0ba5560b583cd4d3d2d1196ecab462c9c57bf5c12b4b0
SHA51290356fe6ff84d1082a83fb91d288a48ce7d389596f733d1f959949f2753d6c80f46cef4a0dafcee985cb825fdce32916a661b036a398fa332d4ba96f90b73f93
-
Filesize
342B
MD542cd185c41dc725c2f431634069587a4
SHA13433b3d05268d4a38e65eb8a896e8d2be00afca3
SHA2568bfdf962d3b8cc899facf86400a7422eb3e879c9e91fb2a166e42ba3f1fcf5dc
SHA512347b526baa18101eb9b2c759c676180ccac499ce1f9525bc1b8866878698615d9ce6edeee571490d5ba568c9e6e0da13d3e96e5cd58c6ada71c8719182f03cb6
-
Filesize
5KB
MD59aa0491e8d89e0d7e637a0dc7fd20bfd
SHA11026277e5e04125136e61e6796bd4e88b6c08b15
SHA2564f685ccead3af6c5760fa02627a579399eccaa6bfd2925dca2b17ec4ce732697
SHA51251a0d6112846b840b34b9cda65f7cef538f249515c4e72c2a4c70f10d4e44c00bc0b01532f4459ac4c1b4456bdbb27c5f939a5fc70047db31cbf7e3f82fdadd1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5719b84f4cee60e0b5d198e9df00cc3bd
SHA187ffeefe83f35ac372808f595be436e0b11029b4
SHA256b0a8a930736235a9cd57f3075a03df2498a8ab484be190629783dc43afe6a418
SHA51229e066baf45d059eae9406ef242d4a115949bf692212a8a7b987a95fc1a3d7c9b9efed202aee74c57780e5f87d597d43b9f50ea570968b1788d510724ad14ecf
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
200KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
200KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB