Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
07-06-2024 16:42
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/CB0A-1407-1C9A-029E-DA9F
http://cerberhhyed5frqa.qor499.top/CB0A-1407-1C9A-029E-DA9F
http://cerberhhyed5frqa.gkfit9.win/CB0A-1407-1C9A-029E-DA9F
http://cerberhhyed5frqa.305iot.win/CB0A-1407-1C9A-029E-DA9F
http://cerberhhyed5frqa.dkrti5.win/CB0A-1407-1C9A-029E-DA9F
http://cerberhhyed5frqa.onion/CB0A-1407-1C9A-029E-DA9F
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\fsutil.exe"C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\fsutil.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "fsutil.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\fsutil.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "fsutil.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {566E0727-9A7E-4AD0-A6A3-B8C77A4C3071} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\fsutil.exeC:\Users\Admin\AppData\Roaming\{F2EF5B1B-C654-DF2E-50D6-9E70A4C82B60}\fsutil.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5c0d0714166e3fa28d79585821798a032
SHA11c92efff5b7025d6dd56c07dfd74999d91194ea2
SHA256a3810e005712962fadde630750d53916980c76051b09852dc46fdb8af8caa890
SHA512bfe3fdc7e18a2494e071ccdd515904b77612683c783b81267bab280721c9bf7ec059771001ea2ae18efd1d8152121d30af38e082fb3a1637cc81462a2aa3da07
-
Filesize
10KB
MD51337d3cb047a1d70b553b4c70d4b7c81
SHA12ad9bef0aceb8e24393e6709b094acec47a53f7c
SHA256895e9a85178af1ab42da9a550106d0f39add19baa9364f50745f4a8f9d922c31
SHA512c15d991a94201c25d885a14de777f9990ebc2b31e8e339611f4922bda6f98afb720e22b7176f67827f5fd77920e34bc7667e0e3d19fef4bf641a86d4fd0c200d
-
Filesize
85B
MD5d39bedaf893d76a224f5b0f743701d92
SHA11e8b72579722d6c1d43ac2143cd44e917fdffb8d
SHA256d9cc9a0b4e8ac752c7b0ed5ba729c445d952ca467351e0d8fe3ed419b9bcff33
SHA5120c28373abc3d7a32bb0dcec9bb7764f7a8fd31e67650425c97a63349dcba8fa1a283d24e6a4f6d532581c5d86ded912fc0cbba689dc1fb7be5856414345a5b0c
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD519b0f1718ef297c436e262bd2c379012
SHA1e6b34969e957696088397e2822c7998a06f87856
SHA2561112b6032b76cda366fc65f13326d98b591a722d4a47ce67481e3d300eda8c51
SHA51289c49a49e01a47a482a2c8bdb8191bfe078aee1308da0585e7a7d8a61852000b53ba4013001cee5edae5e5bc36721ad48b535a0a15c992e76ff758f5dc78b9ed
-
Filesize
342B
MD51d837b1682a5f5cc2ea11864241c8d16
SHA151472dc9da2e3ef1b5a2f38b96f3cc45fd40132e
SHA256231dfea023f94f5dea732ce87df94c3f70dcc1a121b85b7e8459c1cc86aea8de
SHA5120ef977cd88b8e680afbdb351217f297f032cdfdd2476b359942fac42d7e7365e1629ba27d912ff0df077f91492d00b61a2fdc64eb18921d3397bbc7a351e15ea
-
Filesize
342B
MD5630d770a170cc359ed61d2c48a74b7f7
SHA1548201dec5308fdb6f96ba79f74cdf6e4ca20d24
SHA25659f267a92bd6c7e9cab12b7f0291174b852732d90e22534e44de9c8c640ccdbd
SHA512bd09ee7912640ce25aaf3fb070aa0be8664767fc4a29c6fbad0a7fe56551dea677ad25e93880a9b6b433f08626aa3821633b90a8817fd9ed91925f0820524bd0
-
Filesize
342B
MD586a4b1bddfe8ed1c87fe65f498c1db30
SHA1847a07df0523f7096405ac64b45a98bf0941f457
SHA2563c9fe2a8391ca66d212fd61fa29b0692c5e3c2a5e1202da32bea44a468e8486d
SHA5129382ac041d28710e8fbca4c019da8e8b656a1d354545ed89e106b0caa6d544d53c393825c8bedd46d3f213c08fff400a9a93d96fd25dd3546b628bc7fd539e08
-
Filesize
342B
MD52f947224ac5761611bdf8c7ed900f1f6
SHA13d7ade72b57a842d644433612c89b18599b742e8
SHA2566c1981e8bf7a12d8834d7936efe622d78211fbc1c860676773564c176d81c67f
SHA512fa59c6153a18ef6f95de829cb7667b53c24b6b14786978a7111b59045558e207e3b6c0558a90278503bc532a2f7cbe70f64564a00d800bf019f91c042a59719d
-
Filesize
342B
MD5946a646caf6af1a7134968410110a6ef
SHA10f1932728adfb31a5794fc17c17fa699080564ea
SHA256882aa900d6bc4917ddfcf1f647575cd552a4cf1096e54a29869758dc087415f4
SHA5127190adda3b84246ebd4e39618c22eb3f2262310a220c97b469621ed1d62d1f0192fa30a0459fbef899061ca637ed2587527944d3e74f9a872ebb326f5cfc8da9
-
Filesize
342B
MD59c4096a9a74ffb8c9173ac6e6cd0100d
SHA197c21aa85cc89c0459ed83010e58a74ca9bff9e1
SHA2564c7f431c5d17310f1c80d470897221721ac6026e74a35bd4786dc0e0eda10192
SHA512d75b569d22b5f8fa0db3757dfa65e8f31561df9c88215c6a1fcea45a81e60119e0e58e9e7af7fbd6e76530760eec401bc602791fa33f0992f99edfdf481a981d
-
Filesize
342B
MD519c8d3c8480766dda75b11d856cbcc41
SHA11f9cf25f1b471ea142e9ae2ae0a56ccd27997a34
SHA2560398f44d3133d03cb3e1d390bd7ea4b7bca8dd26818208bcfd943243c0f0ec87
SHA512ea6660ddd83088b5022529e64039329cd0909fa343c293fe0decdbe6ee45f6da15429dde04e9cf8cd3840c24944d8041f8c4a009ae62c1aa72e678686b39772f
-
Filesize
342B
MD54d54466d9feee172124cc6e9801f70ec
SHA1d89b355b6942c9e6963d732470835d9f47a298fd
SHA2566fed693e751d5658290f2ae2a9eced0c2531677f825e4fb917a7dce238c151f2
SHA512aa7dbff1328396a68eb74249159ec9918c25ef30256220bd7c8a366c9adf3686297469ceafeb98268493c7d5fdd21110ae1dc53e65ee823505154567e659090e
-
Filesize
342B
MD5beb0aa0f32f08e1ea37bae85b666cbe0
SHA15c8404e8b97b2a118f6e48184774052bc7d73e48
SHA256788c743b33ea024cc182feceaee12ebd5512fa2b4a1d5f11c7636e44cdfd5132
SHA512e5e1af276fa34518c52bd6a085267a28ab006a5beac8257529154cf03f904628451aea61cd8516c9a0eaea1d059a7573859eaba6a5e7fd7bce77e37e77fab57c
-
Filesize
342B
MD521de7d60ce7072411cbebec505239abf
SHA10d29dad40d592b26bd7a2af5ed80f3cccd667079
SHA256dc0a112cfac307c041fdd499b386f1041b1494bb0b9f737710e55f1a02769a1a
SHA512fe5b2df2524438a6ef433bbc20fa616928619ad0d7ff74711893e989842be5770efb4c388c2f6150560f210e005feedd4e7b0d8116cec97950d3035da096838c
-
Filesize
342B
MD5dfbb683dcde42e93fe66b302284b527b
SHA1a3224b54d554963b8bb513daf3a649b95ece6af9
SHA256610ab2482898df3c0d1cf1275fe136d2779b34f8d0d9f8ddc23d1539f4536574
SHA512f2979bd0d2007188ca886f7804b31cec7d4b22bea4b39e6d2bca1129489a0d2be609246e74f53af8968a0be8c093c3eff6dc356881aa9a563e4de04e55fea5ef
-
Filesize
342B
MD5de1a49fd5a3ee870819bd5cbb9478189
SHA108d778447210b78f743cf45cf92270c778a6fde6
SHA256e397dec60c5d27f40266d034de77d33f082fb3626f8efe14558c538ee81ab30b
SHA512b19294c46118b7be0e3ed6e5fad90fc9fcbf433c8393c68b04c870cc4b78ddff334b4db14f19cf7eb53a7a044910a3c60898f1b4844082dbb98ef7e83d396b1f
-
Filesize
342B
MD5625a1bec2034cc827f9f6ecd45ef3abd
SHA1eb0c09be3f90f58e4fb2157779dcfb841e21b4aa
SHA2563cd1155f0af52f9cd6800d9b969d2d88f06d6f4b9c6a8eaf5db733c836524a22
SHA5126ab6f623234c52685eda6d535ca1319d4af3d0e5ccc7df1f4883553e1959226f6e644ff1aeb0f91283fc74de0ff543c4724b81b5076dfbf04e6a9592178853a7
-
Filesize
342B
MD5ab5cab1b0eedef64b99625f8e14c076c
SHA1524c72c03782079396bcf9898d44d7a90e9ced6d
SHA256fb02998a814faa100e04320faa57592d1505dcffedbdae28c8d7b85d5c98bb3e
SHA512c4d17f2b40cd0c37ca5b70e569c759cd7b3f7d11e69ee528b1187f56ca957e7d83a2a182e0c034a4e5fce1d457b44568a707f0ffb67d2c3a35f6e4d13c2d490c
-
Filesize
342B
MD5246ebed109d7eb95c2c4dbcafe7b7502
SHA14a4dcf780b27933d54ff2765339071b3dfb31ef6
SHA25686958f7176dfd4d11329b0e7c61ff02f49d03b44ed97efb6dc180d3ee55ce35d
SHA5123b2aaa3c4dc57a86d16dbffddabfaeb51c8224ea05055915f6ea1dfde8d52fd58bd9016cdaee7a7b9748b4c26f6bf1402456dc81bbe774de9bc8af5cfa7a8c43
-
Filesize
342B
MD5916946e336582b961596fa935adabe04
SHA11e5af92793b5d54c8995f0942298597d2fa17efa
SHA25677b4818e103da7fbea0701e8a69e8e2625ad49c43357bea5ba47e0800ed9bc56
SHA51247e0f55881f78ca17eca401995c76e98fe881456e035a7c90505471206005fc94d8f06a4bf066dd185d8122568bacae784a538b857e0011eea23075cb86c838c
-
Filesize
342B
MD5bdc56dc539d1f3b89771d11f116686ea
SHA136a9c9fcd628cb56fc09d0e787d0a324e6833f30
SHA256a614b0e9875202452c115e5f18ac0fd5265faa33dcae5df9c5dcb1603813742d
SHA512c468be4bfbcd822935f66a99d349267573b2ad3b48b02d6e9a966dbcb37de6fe94bd3cf9d5ef63cade685b36dc7135de29fa3fc49da893c751df577e31590a81
-
Filesize
6KB
MD57ab8fd7b60a84915033b1ec4485472e6
SHA149ed3bc970cda00a5d9cf96acb59b1ede3ba0db2
SHA25648ebb2dc691d7a347baa728888946a9132d90f2faddac1c8cfc1d57ada7851fc
SHA5120d36a78b8bb077a5d3bd0a30fe97d49ec60ea7fb5326d4e55839a89e4e4e39b7e257887002eb6284069e462eab5b8a8ff80d93cc0cb430990236cf7a83f4a978
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5a7caa24241b5c0f46af90ecfcad1827a
SHA1f936f10b9820eab93f642923cb16defd45e79249
SHA256a0cc66fb34fd6aaa24e6cbf6314d207794561de72390dea442006abbbbfc35f0
SHA512f843cfbd721f646fb0c9306663205f61db63f7cba5b61a6283e932a65a945b24a8e90a6f41b173905689a2565e0486daef4db3bc6223e269d681d3dc7ca02aab
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB