Analysis
-
max time kernel
126s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-06-2024 16:00
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/486A-E76B-ABBC-029E-DA0B
http://cerberhhyed5frqa.qor499.top/486A-E76B-ABBC-029E-DA0B
http://cerberhhyed5frqa.gkfit9.win/486A-E76B-ABBC-029E-DA0B
http://cerberhhyed5frqa.305iot.win/486A-E76B-ABBC-029E-DA0B
http://cerberhhyed5frqa.dkrti5.win/486A-E76B-ABBC-029E-DA0B
http://cerberhhyed5frqa.onion/486A-E76B-ABBC-029E-DA0B
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\PkgMgr.exe"C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\PkgMgr.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "PkgMgr.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\PkgMgr.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "PkgMgr.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E33769C9-69E7-4765-9029-9DA186DA978F} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\PkgMgr.exeC:\Users\Admin\AppData\Roaming\{C3E8D47C-9F43-BB75-694C-C844176198A5}\PkgMgr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5a9dd19826857391502220513d7c80657
SHA114576646d05cdf140f67f2629cfb387f7b9514df
SHA256b12fb7dbb557540dae1d39fa5cb87aa6474313b6c9cfaf41f3cc78fd45edcf7c
SHA5129dad70a32269f0fe08c41fc91b9df85dc9dff6ae1f996d270e64206a40278e81442e7a68b45e44f1b6c143856117703a54bbed593fa38cde45f3d3438cf748cd
-
Filesize
10KB
MD5de0028da4d4da20175ac66c7b233dad8
SHA199bea4103bc01b65a5e8aaea163dc13fc922e05a
SHA25616059f335b1da83a9bfda459a912b111c061734afd7d3dea56696a6202f371d2
SHA51254af81ebbb2dc904e9570846bdb9a49c766a1ce207f168d58934ed4863403a659249f2e9b8606445dbf5463f4b5018dd31067cb722856733a9ec8e7aaf82ec46
-
Filesize
85B
MD501b7c9357cf73e812f390ab5424772fa
SHA116984740ecbb4e5bd916c9c643812103cef620bd
SHA256350c2316d2177c48947086998dbe955d2818e7a975c1d0678b4e35d13d5d0714
SHA512bb005fb0f6463f62a6ee7fc5892938821d893ca3b6608b65f22509d6c3e4c601728c3c86f88f4dd48baa8505f9b3d82eb7dace072d978d581c0b5812a6e85f30
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD55aa272d34086837578d7afe6db0e9f55
SHA1600c66483756b735794e0f20f0d522833f4c8e20
SHA256329bb89df9ecc7aabe00e56c8232a556f345489a74f123b25f26261d15ae48f8
SHA5127182401f1e6c718ad0543abb3ca8e4e4ddcc9cd479bcdbe805b06902c99d3d967293804214368ee9b1cd22ad6c5f1f97d2cfa75a1568a63ab77aac43d06c3318
-
Filesize
342B
MD50c874ab7991b771d117e109502223d5a
SHA15fb854461bfcdc7a7b4123a44a55aba0540d1656
SHA25694132534d16cea6d22602c302b2288aaf37e8c8b0418f23d6f8b237b52fbad04
SHA512f7b22b5bf8ebc4a6661133a57f23a2da6a1b0c02da908bdecc18d2e2bd8e499e384d16eca4bff1be8661faa1828c4527f3891071806f0595bd7b50355ab4b3e4
-
Filesize
342B
MD5700c2692c51178889caf6944a85d93b4
SHA137df5dd2bb923d7bcf5cc6b0942d4657180f4c64
SHA256d31285a0cce72b4c9bebb54b12ea1327b14318e7a1110b4e7d3461f67045c7e9
SHA512ca3eca1c48e957f4ac1e19cdad9ffbaf7b8187e9eb6373ddd24d6dda3c4af1f2876f9d826208b87acb50ee2136d53334cf3e81379bc4c6e542f2f095eef0d5a2
-
Filesize
342B
MD515b9ce2673c5fd65e91cb8f2cfaa45c6
SHA1e1c4e30a037c7dc75d5cb3fc2842d87af61adb84
SHA256039aa2d0c799c4e4c90fcbba5ec1e0e8665a9f5cd402d45154b3fa497ff96c5a
SHA512f6799536f4c1f0f478ef5bf574d54be790107d2cbafcaebfea86d6150b4d7162354065d1deea1056cfc4da237c1bb60013f62f08c1f0ea3026e9e75dff451fe6
-
Filesize
342B
MD57b889427b4163fed6b883f709a56c610
SHA1eacf6fedfd0086f67624f61bb1731f2e1af5195c
SHA25686ad01fa273c76e952b1c76b3828815cdd6cf2ef35ddd88e71aa85da19fbe0c1
SHA512a817f50cbb32d5aba90ca9632b95062c62ba1654fbe70f8aaea1b062f4052e214cb69926547c2a76379a7f4e2797a751c14ea08995ea49baa5c972e8f00e3d23
-
Filesize
342B
MD5015ac7f78f37d098f910bf1fa0684470
SHA12f01b0b08e2706b29175a10800cfc40bf4fd9cb6
SHA2560a821d1893675128f9692dd173c1dfd3fd645c10617655b7a01a550ff7369902
SHA512d69037501b957aca98956c714cdd6dbbd31e27becd67cd447254e64393c2ed28337bbbf78303576eb413fde85aee7a033df483ce79d6307ccd51c1185ca4f0c9
-
Filesize
342B
MD593e82b62abc8a4dbec020232f2756931
SHA1b833e3ec0ed8f210f430c5080298d18f0c80f96c
SHA2564c9766c8f509168b1a74c7efa6ac0b8b0b078564832a88244ba45a785948b3dd
SHA512a87d0481f638b94e96a11e62443a3e51ad08cac1725a94db26da7ab23abfd7b3879f24711021c87e7cd7dbe1e4c99d15ed7a5f18f140d205a1d6da3d4d90ed7d
-
Filesize
342B
MD5f227ef7d1102cb3de1ca32eb2466906a
SHA119a9df77e1e0293e21a7916a0932868b5ec4f1dd
SHA256e7e5919e1eb90ffd5830b67b2813735edbbeb38ce281312ebf5d0ab167e6509b
SHA51281b0e9222bd75d81046fdb1164c868dff7f2245b970751b5cd8a4631f7277c9077e1ea8e0f8f34086cb7335809484de04c07ca732665cf349d6c03b91322cb07
-
Filesize
342B
MD5592160fa827a52f062dee010fca2bbde
SHA137cb500aebe2be2b8dae4714a092234b586062d8
SHA2561b2b11a6200a6b96ac9e539a0773203059e8da6fcee89b8e7eeb3a56611148fa
SHA51277fac2e95e7e822ed639bff2cc043124c2d3351139a181d1b970d719b30e63e13f8a6a23d03b98239b5b2ce1372619a1415f271bbe93e26293714f9526bf93ca
-
Filesize
342B
MD5f50b2f3303d10ec7a0a939bb4690a21b
SHA17764c2dddfca369cf30b503d0ce80270db2dce0e
SHA256de50048de1a38dd454ce31a0f84449d1c4bc3a24e9160c96da2c6450d618b5ab
SHA5125b357540df1b80879d7e877fd63cd0f61386b47ccfd095f5a158279ad12d829816fdaa90f20aafaa5e4cece2f4be136094833d9d5dc63ace23f2fcff846e1459
-
Filesize
342B
MD5c7a05abb0648f0bf35b65e39128be173
SHA1d2ed569445308721b24bfff99828ab02f91a3afc
SHA2566b61b7d38c16b1b8cd2db5c1a76db0a8c2b118089950d5d3e43a3108efbd5ed5
SHA512b4af5ba95d1e2f4e97ac1f00dbc30204b06e636a628361f6dc1dc5db244f2df910a68051459405bc137dabbdeda20885ab9471bc641e3d07f2a2dacd7cb3aca8
-
Filesize
342B
MD5378e85714f626dabf247e6c5ee747ab8
SHA1313865a8e5378da217db74892bf13d3ea65f398e
SHA2562f4e68a13d95bb3c38f6d0c74faca40ecb3e17bafc2c6071cda406ac40d0c87c
SHA5120ee6410b7f6cf3ec83d6798fa9babff58d77ea4233da58cdf8f09c6a5f9203757267e27b98e3a944d3757fa250aaea3ace49aa5625937481b1530e22bfad5f9c
-
Filesize
342B
MD5600f07bb3041ecd130cd694c7e7605ca
SHA18d7e6c64af49a861b9f6f047b41eaa6a09a8a8c3
SHA256453c7b10104cd4efc05a13d4a494d7d8077b39d45c79488c9275cbcb1eb92a25
SHA51228e088d9e740aaa836e81596e7015cdc27d9e3a6b0c82ae2fc8332eebecc2a936deb6710e0840348af12e02f18088f9ec0578fd151e3e9db55a390cc63a01883
-
Filesize
342B
MD547c03bc12110d2ef16ef3262883af899
SHA160d67ca6f3f155f237f4101d9fee9095696807c8
SHA256348db09d7d331c91be1a97fcb421015b2dd3eb3fddd8deaef9df9fcecf94b145
SHA512db4e94073dc5df8b5a34c1dcb501034860e368db6fd0ff8ad4b9d72ea2f32768160ad57cd662d0fd771acb660c7b40e6cd178db14508a85edfec4ea3b7055302
-
Filesize
342B
MD51b1217b21de568265ab213298e6c7145
SHA1a3e7c6d9bed97a2a284738898b11c777072d7789
SHA256bbd344e6ed88ad2f78e300d78dfd960094d8586cd53d91536d455f9e869b55ae
SHA5122946cf1bb4e4a0ed7d30333d9fe99a3a2766bac93a8ea4e7fb96585d1685614cdcfa914fcb969744709d199f2b1ed67bc3ea4e9ca1d6a7f12273bd8ebff041f8
-
Filesize
342B
MD5f4effbda93c6ae15319b06ab94b32cc5
SHA134fe6676ff863f90571a48278e5317aa296d228a
SHA2565fecb5bb2fc1b5a2e01cdb075952a8bb779fc411355fc55ff7880b11a9a61d62
SHA51295087ecdc6563452e898a93d1a05e7ef9d8a700cc5fb7cf42562ead1db9db6ab09aa24869c3ce6e21a5d5386fded953d9dba64b4f34017b5154a1e0f3cc73b34
-
Filesize
342B
MD5fe5874030cd39bd884e563077e4d9e39
SHA12b0ac85fa1d56bbb61ff670d0b7af8bcc1e4b777
SHA256fa8985e326f20a268484baaa34452a712783f69786eb872960e7bb48165b0d24
SHA512e36fc0ff26a5b1651147dc20dde2c31c4960b899be3bf3d92591034996aef319dfa3af51566f0755457b9e4237addf1a38c08b1f07a402dc7e05007bca44333d
-
Filesize
342B
MD514237b62cdd81075a1403ed9a3fbd432
SHA13510cb21db6ed6e9387b6274e95bd3ba94f189f7
SHA256cbad1ff5486539379ae869dbe28502aec9988a2cf0666fef2db12c07aea993fb
SHA512d885ea945d1c4380398d613480ce4f6a01a650f73ec08c2fc25f9d738d4b3ec4036de21eadb0970eafff5bb9bdbcf3d47963a6ee61fa972356139a31cd9e0f3c
-
Filesize
5KB
MD5602fd1d46cc14bc8508c1d27644bb87f
SHA1b3898102410c821285bbe20ffea242c9c8b62f74
SHA256e4e2f9c64406aafd3f458bd172c0627108e24d2a890de33b1f98621a690fe6b7
SHA51290bb4e9791aad244550ca223959bc40fb8a3031753f11058ac3a11fd6488dc41bb1eadce65be63aabf1ac649afe9589486abfa230330d1c7665a008428294c9a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD574f359e280f6a4d2339f2bc7f082c37b
SHA1dc4b4b95a36384a691a427e5ff1145355f4902f0
SHA2565a70cfdbca4476166bbe14a1503aff7c3a08cd1d9a84fb9683152fa86c3859b9
SHA51253617a13b267767ddb16c2d3aa8c1f2b5d5f29baba6cf7b2d6a4f1ab45eb41f75e3fba090a1b871ca0cc18f916287063299715ed58665eecb8ebc199a0173a76
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB