Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
05-06-2024 16:57
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/DF55-0C2A-E28E-029E-D81C
http://cerberhhyed5frqa.qor499.top/DF55-0C2A-E28E-029E-D81C
http://cerberhhyed5frqa.gkfit9.win/DF55-0C2A-E28E-029E-D81C
http://cerberhhyed5frqa.305iot.win/DF55-0C2A-E28E-029E-D81C
http://cerberhhyed5frqa.dkrti5.win/DF55-0C2A-E28E-029E-D81C
http://cerberhhyed5frqa.onion/DF55-0C2A-E28E-029E-D81C
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\certreq.exe"C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\certreq.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:865281 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "certreq.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\certreq.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "certreq.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C99F4B63-85EC-4454-B4DF-D0183C65F745} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\certreq.exeC:\Users\Admin\AppData\Roaming\{B4D97F26-2571-67E6-FEC3-BCB500FF708F}\certreq.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5a598d40a6b48f7fb4c87e052b8025f58
SHA1bfb6ba02f274deab155bb53a3adb70bcd78ad1a0
SHA25676adcb3607500a44ec6ff6839643cfe2559a03799b7be8b22e6d957378b86dfb
SHA51231a89fd87bc9669b03c19f6f9985bc9367e0b2ce0e924666a108403d87b9c09d709579c3d286fd56405cd2134c041db903d35ad4b99cd8bd7f60139ae29a9895
-
Filesize
10KB
MD55431e5f1d74f8091ce0b08c2e41f50e3
SHA19f708681804baed14d33b87a314957a2a05c9b4a
SHA256fd99f70a26d886fd448cc5ae2c568c8e887a523c428b364bf2b8c0263f93e34b
SHA51226d0758d9b3a417872727280908c6ee49be867da82230e3a9c1201d85e3e6b40e74324d373135dfb55d51247b96e426448aaee441392a6d1ed562bf749fc2bf5
-
Filesize
85B
MD539e5e9fc3fae709ba2bcfb7064113659
SHA17c7f831a9cf096f18899c4d669bf8508b25db1b9
SHA2563148e9f63d52b05fb81d24eb7f7df5eaa02d36d291cec7a706c336aa54cba1e2
SHA5125d9da7591d8037840a1b0ea8e9fa5edfa15e089404fb56c2e595650835bf98c6c68618c113b17e7b15b402012e1f872b8b2799bb37632432eedf3d7bcdbccafd
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD54ec9aeb6ad1305804987fc661625214d
SHA198a73950deabfa9bf6d068005a4784fc4e7ca796
SHA256811cc5cd45ab9dbc30f7a0358fa71be8350301b779d7d60bd5e17fd88594f8c3
SHA512d70944097f6eaad28a90b11797b799a3001428cd4f79053c78224155a7a76c70a54e49f22e84538577d8c8507c685607df8c727d76df20d74a7708b282189b39
-
Filesize
342B
MD5f088509cd8164d76e20e3321f481a62a
SHA192bea7b1e968851150370b9ea26a2f3da3434619
SHA256cee8d77f13f8daba1c828c621442972783a37401a428fcb2c269a50d359c95c0
SHA512c4f99c5c5f2fc1d9dcd6ed3af686a4aa09a314356af33c12fbdf51378b61598b6090054784d855e04a5a41da0e8e70977ca9a16ae0f44804bd54993c91053fb4
-
Filesize
342B
MD514fbed77f22f934fc9d8dd6edfc1e9e0
SHA1ba658c4e979634c1a7321500e064828641d2f941
SHA256978d726c0a7adbf51d0ac8fae3d3ddcea625e997b797e74a9cab069548634e6f
SHA512b182ace057300ec9428f7e40431783cac5a0148979457f0bb847ff5f480b23e99da18556c79b310c250966e85ccbbc4cbf42eb22e30520ed9b0b0df5b66e058d
-
Filesize
342B
MD5408d6a075689cbe29358a43802b4bde0
SHA158a35fa0e17dce503bc70296871b93cbfde55da6
SHA25664f4e5117cda7cc1b5d740114d1168a1707d0b03e9a2b4351915fa73f3c99332
SHA5121bf335e0bec1b99813a33802412ddcb0f247c6de1a1542e62c6cda448e8b70148db8314a45b88fc0cc774f457067b623e27941c723116d309e6f4fb340fb783b
-
Filesize
342B
MD585724b678b3d90684b221569e6b159c4
SHA193cb1ee96aaab5a1f0121f3475c0d1f1e3857024
SHA256db01537fb5bcee3036082eb889cc428eba924da21d00484f175f66270d959bc4
SHA512f88380d5273448fbeb3ff39cc69586a0598bcc346d7a5e2c81a9fed1f6a1160d5968eef7f4c92a5780649924d54b15d9084f38dfb57ac2af970d9fa6f9e16428
-
Filesize
342B
MD5e4b73e86e2b0ff6646c2cafa54e43d24
SHA12557bf1fb426a7565672dfc0d8ae11cd201aefe6
SHA25606acf59f7903e587ea7595d92833276c96460969e0a50163eb7acd2302c3e6f8
SHA512949b753dab3ee0b411671a38b8203d75f3108bac044064ddb486c593762a9d7d75759acbc28b6d0356ea1a62ff1e2e7f3b6f3f2dd234b6f83e6eb4a9b0f7bd16
-
Filesize
342B
MD5afa960964633f3a6f123faa74ccde8cd
SHA1e2382afdac1a4da766fc62002bb17cf84250016f
SHA2562eabe1ac74f9f74ce23ea718885e8b043d7824f8f7ff2f56147c5bfbe3a2f3c4
SHA5122310a9a20b22d8a2d56e7976bb902c4ad4d3039acfa54c7b47bf189da928c038568629e2e3c0fa6bf1af8a3091e17e1d23fb7987ed088e812835d7e1aa7bb1d0
-
Filesize
342B
MD584da94e2a8a19ff5cb7ab95347724e33
SHA110870d96bef9031dc55723d71ec571277166294b
SHA25647b65f6182c66767ed8544522cedd37c019b0da476b3bb74446e83ef98d53d74
SHA512d5406d048a670b4eb5aceec312e1486ea9368bf82250e5c92c24eb1fc94d970461d8a679aa947ac2ee1be372e1cb683a7ff8148fdcaadc14d0df1cd6e4606a27
-
Filesize
342B
MD5a102c7518fab4dacf4a3573096a28b2f
SHA19a88cb1a76ee9628ead7900b4d6457eab2c81cfd
SHA256b8224587535efe8fbee76798eb04177b99fabbb5d4a5ee18612e39d2caa73a89
SHA51223311cc7c250fa8666be7763993cccaa321eef26692ecd905b47ac2638c935d1ee6d852360e12537ec3451d25afc07576c47a846a15510d5ab750116eb418a33
-
Filesize
342B
MD503aad6fd9d72ac169097afb60813771f
SHA10939a55525c2e4cec6b4361d2d45e5263de34f1e
SHA2568eea1bbc45ba787e18afd3ca3eeb4a2db95cb44df0debc7ad704a07163f4e37e
SHA512aa13b5ca63a941a59b4106c4b98eb85436087c48e17f40beceec122292f96d15596b89bc9ac7b3a4da354fe2c254c5a83f133c912cba10e719add4936b7c5b95
-
Filesize
342B
MD50808676090b6d40d25aea1348ed47bce
SHA12263087bd9b33865097c6a75428699d5ef8f5b22
SHA25622a3f601f52f5dd43579595ba3ef51cf1eb30cc32570fc547e773e797b659e85
SHA5127000c33065579455437711f37d769c0482785565678a86aadebc5e3638ab829b8fa77d134cd3400a783df7aa5fc59c5d9e9888781c305bae0058af0c340295d6
-
Filesize
342B
MD5e3e6d008eb439da51d837dd73cc98019
SHA1d33c8d23d19868fc586abb304bd1995f389e8850
SHA256c4369dc6e457e67cf7f6a602991a0a7e9b1427e1854bcb6c8e042cd157cfd852
SHA512801215e774dd9232acdcad6331d2d967d0e83edd9d0960b63c70c395dba861b962dd4f988f95b4f9dd04d945feb61690fc3d84910ecac7ce81014b6c38691cf0
-
Filesize
342B
MD5ff80b5ec731d91dfc0c297e7274b8b16
SHA1ff0bdf5fe11aab51c78068db2089f7561930e0ac
SHA256d5fb3b857469fcc2d15bec415d1d9d79f243ec0a778df8003190a727d1ee0e19
SHA512b435819570e94483452b440f157d5ee94a583b1410595f07df9705118af074b639f1648e95de7d8285e8becee1ec24f48e6cc089e2d7137c4b124e1af187097a
-
Filesize
342B
MD5eebdd34a4e506bbf7406a29d55442270
SHA193eb66cdf714f9c21cd4198a0aadd2f1b687c369
SHA256388e26debce71c7afca7e0ecaf3487bb1be0e8f7fbf8afe603b398f156b60982
SHA51255415049195734c4725eb5b5c76d8406ff08f4048eb2c99b1c8ee72870d0122c3a8ed137b64b7d8d245e8481b77633b3e848b9032a7c8d9f37f25e6b4543fe07
-
Filesize
342B
MD5881aa72752fbe305b689471b35afba82
SHA1360dfc13567c5ff72454db6bec8a0bd152a7fd6b
SHA256c36dee0682af217d0b798e8158cf9d27b68921f17207363ee23c49cac8e14372
SHA512c4180b38c4e45e205841c594b2349dc783002b48bbc4db168b12ed29410cbf00b063c73207d9e390a1f8afc41a474429e2e9626523d9200aab8237ac041f2bab
-
Filesize
342B
MD51099461194ef4eb0197332ea5fa0eb5e
SHA18973f5f536694ac365144471b658f667da6620bf
SHA256e92641741258be9010e0651319ed3d67fb0cafcccff57b88690ecdd0ad612937
SHA512998c3337330dca844cbd211e30ee6cbe9701aeb7f98accfc31b0bf196c27800657f1f0d940d0420eaa5cc7da66070681c1ee961bed52cd2dddcdf3ef14911980
-
Filesize
342B
MD5c09e505114b478724d79cdded95cb9d9
SHA1cbd2b3686cc1ca625c20e3089ca8c338e559d3b0
SHA256335ca131956783b2ebda6ea0fef2e36aeab090114d340144e40cac34c7b847d5
SHA512e23d4d7527cc9f922a6af7df4f32a6bd3859cda73aa0b914fab9a26bfda5476fc482fc569eb23a9e7561ce62a952f506dcb82b0a24ab25461f72558d1e056da4
-
Filesize
342B
MD5295bd39da215c3f3424a772535a5f5a5
SHA1d32d0592fc54654e4fe453a99f190e040ddd3ffc
SHA2562cbc077623e0d07d2b125004bcf2127bb30d5eb0b7e5839ee4a0c5be775da545
SHA512b8391697754a161e6e5c24ae7073f3b4f065d81993cc01b759073c1fb2327eb0a493adac9a517620f1099556a8d8630edca52c0282df61a4b1a0157fbd6edf41
-
Filesize
5KB
MD52d7b407dfa0674a919d59154129f621a
SHA1f4b940db3b1414ddcf0d311cad5f088d197ebbbd
SHA2567108588c4c9c9df46cb5b48913a6111189cb3e445c2932908175ad636c6ee07a
SHA512d05defad74a700ce3dd0a7c553b5d3a5f4cb7b9f04d7ddbd90c837af4274ca66f48c05d319488027f25ce04d62b99d1c11b995d1d5f59b1a70eaed1e5832c908
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD52ed51e4598fe5c82310d81e5d8984d12
SHA191ac3a18f1f1dcdc73bc570ce8cddbb7d85b4199
SHA25614570f15dd14a662534e10467705a6ab92f87890ad3690e55a61975cfffa8b70
SHA51253810b89e2f3a714c1ddbc1404f6a97160d6858be3df73ee59de3da6ff3d88b28ac9e3f29d9e4e031f8dd0f944465a38b52e6fd6be2dada124969a944fb933f1
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB