Analysis
-
max time kernel
128s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
07-06-2024 17:03
General
-
Target
VirusShare_8ec363843a850f67ebad036bb4d18efd.exe
-
Size
186KB
-
MD5
8ec363843a850f67ebad036bb4d18efd
-
SHA1
ac856eb04ca1665b10bed5a1757f193ff56aca02
-
SHA256
27233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
-
SHA512
800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
SSDEEP
3072:TFFzdn1bwoWwW8BplOd4G5ts0RTy/L1yib5icNisjx3jUiXy:TFFzvwoWw3BXOdl5Ts1yw0s13jU5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.zmvirj.top/DB98-3955-5586-029E-DA7B
http://cerberhhyed5frqa.qor499.top/DB98-3955-5586-029E-DA7B
http://cerberhhyed5frqa.gkfit9.win/DB98-3955-5586-029E-DA7B
http://cerberhhyed5frqa.305iot.win/DB98-3955-5586-029E-DA7B
http://cerberhhyed5frqa.dkrti5.win/DB98-3955-5586-029E-DA7B
http://cerberhhyed5frqa.onion/DB98-3955-5586-029E-DA7B
Extracted
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Control Panel 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 61 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of UnmapMainImage 3 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\dccw.exe"C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\dccw.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:865281 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "dccw.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\dccw.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "dccw.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_8ec363843a850f67ebad036bb4d18efd.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "VirusShare_8ec363843a850f67ebad036bb4d18efd.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C9844F60-C0AC-44D1-A6C7-5B8B8A99718D} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\dccw.exeC:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\dccw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD531ee1493fa15aeda7565a0821c8797c2
SHA1caaa521abaa17c4d067bd67a767ed1e96f29f7fc
SHA2567a7451a7e08e456a74c290090e630bf7b39ddfdcb396fa1e4adc57280cc08e90
SHA512ab13b8860b727712200669e2b3a90702382239915fdaf3e611b7acdf76b688655db3b8340dec8f6b1f404b7a0f29758b42dfd57d5b4af0c5b4eecf032a6900f1
-
Filesize
85B
MD5f6479c3defaa26c2b62d124ac0cd9dec
SHA1bb2df9d9b9519adb57aa6bf96b264e1b8f994603
SHA256e8782f70710dc5e2a5f21fe4cd686198f1d29a896eae8ae13f91c66ec8f27e6d
SHA5122923e4b492600b38fe660ded4af5ed2364adc7f96e0049cf92298098123b77c0b896fb0879a0a225a35e923f425ba661af29ce87cc76063b9f4647355f06f75b
-
Filesize
225B
MD5f6d629f2a4c0815f005230185bd892fe
SHA11572070cf8773883a6fd5f5d1eb51ec724bbf708
SHA256ff1de66f8a5386adc3363ee5e5f5ead298104d47de1db67941dcbfc0c4e7781f
SHA512b63ecf71f48394df16ef117750ed8608cc6fd45a621796478390a5d8e614255d12c96881811de1fd687985839d7401efb89b956bb4ea7c8af00c406d51afbc7c
-
Filesize
12KB
MD5f1bba0db557bf14b1045e7089181b8af
SHA122faf91df0e0198cbe712fa144ec113bc8d19b1e
SHA256367cedeb59bec2f2c9d775573fecf07c08140e80f641d875bca8854eb93a37a8
SHA512491dc8194970b0c87457dbbb5b764b7a6d877f94bd419e85b01472ac13e876e0453b203fda5d21c293a0063c447f350f9aa059f209a743160278e1fe1a27383c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD593f75c3ea6f97d79c0e13ce03c49a40e
SHA199889ada63876b1ad391e01a4437ee1f01eb63f7
SHA2566577435a6e396a35e1a0e65f3efea35a29746462b8ed668d847a1eee1cd04a68
SHA5126bf3320d09f0100cc748fa6cc1cab7827d89be25d72f7874d33f8c35af0b1b8c01169b60acd5659a9bba207bdbe5341cc4d3a9bdaaab9072e19ba36330f30187
-
Filesize
342B
MD551d073bee2875f5d9a16aedada2d5358
SHA18228243827b33b88aed05a6d1a0393e9f4e8a432
SHA256a65b3b3b909245ada53ce19be87f5aa24118b1bb1c54ffbd72517632ca3a1496
SHA51231394b5d3f95beb31cae9260a03ef2d09f9f63593c7182fc5da063d1d44216acde8660f53ef17b7b5267e5a0fc8426dc399ce5d8a70dc428e2b1286d5aacb568
-
Filesize
342B
MD5bfa057f4eebd719cc19d6ded9fa7870f
SHA188aa9f2544544e77ed8ab80d9f1077bf6fab73f7
SHA256e871874313c910bde9fff6377d41a5cdc6ac99c73c6becbe6cbadfb67768bfb0
SHA5120cb84c8b7de44012524b3c48b5a7cf637c1985b26b1d5e40dae4a961c7f2fceb8533f923492fdd2f27644aa8c937f021f45402e2f4e37e0af3716077d7b579c3
-
Filesize
342B
MD577ebbe3b16d44f50a0f0514e25e91fd2
SHA1df495f110baa5ab0cb4f9bb8e4415f2fa91a1960
SHA256ff09caef42ecd95129017c40347082454e7da990e83e3e838f1f7391f292b428
SHA512cbb634ccca527ccdf25cf7eed0401f971aa5f8df128b592e7da9fac2e021a4e9348a6d208acd3988541800617397d59adef061877e0bf40e747715af05b6a5d3
-
Filesize
342B
MD52995c71c78647d0945cc88170c2047c9
SHA1aec7d6850a7c6648197e02c36d2a8f4a70613d96
SHA256605f1f6238df081f60cd21f7e8efd95db20367a4154d65a799a89315160f7062
SHA51201069f4d5d9391012975a4796853b1aeedbdf95603173eba9a4a5197dc23671ee7adaa1f441575b16abf8ddc58988cbd4e2e8feab8ed769bc057c864f58aa594
-
Filesize
342B
MD537b00679574a28b056450c3ef0852c0f
SHA1c60cf4dde6b0c11c69136a071973a78b810376b8
SHA25680be94dba5f06e697b7eff7d61ec305c14af2064c3d3d51301d9085a58854392
SHA5126df0f690db9b06bced1dba4241c2d140b60b8eab34d4edff0ac7adef0bc0d476c82b19b8a7a6ffb08fa09b19cc945650ea497f2dca33ef6d8ab47dfc99b58a85
-
Filesize
342B
MD5bddebff3781c3dbd5f107d73c788771f
SHA168f937b1dacdcac6c6a25f9aef05e7b335bbfdd0
SHA25683467332a527a79f843db35dfa6c200894af4d018dfc3b689dc6aaa96a268933
SHA512af2478fd63863f5eef1c59806a09ba820d595a5553831709229fa3909230a0f80b81dcd903359b833343699b183d330c0871eed1c1e053e1b151d8885cc15d28
-
Filesize
342B
MD5fee760befdb2a62662a859ebd64e4e9e
SHA1827958ad45d833c6a36b205a7148f6a90ee749d5
SHA2568d06c8a082d049d8df855c06cbc1aadde5334a3c85a250916387c2e90139775b
SHA512df7d105634dada0dd1e9f006c01685cb7c8b0c6203e15254823c0d34adbc57d9c670022aae88a35296c29f639041651d7b420a4f8f4dbbd2c9a6e835797b81dc
-
Filesize
342B
MD5d73255e750aaed58c4a2ad0be4d06aa7
SHA1b1009c15e0b5c0044868940ec2d35c55e0b30464
SHA25664c4c8a6e514fe8a760f4fa0fb9d8c2231135c14e7306d6d97b45af05400b618
SHA512e236cd4df71a041ae59969a5c0ea76f1ada7b1efdd908333e112b246d7530f600efa828d3d9ab0df16036a70bed2df98e3e23a2114bbc97b5b63fb2f71bd908d
-
Filesize
342B
MD5fd0ae093c4b5acb64e3c9c735bd953c7
SHA1e3961414767a6d7526021407575b80294f742b3d
SHA256b6039229d66376f14296f8c1993b2cc3b91dcaa520c75fe6c047ffe913f80c74
SHA5125510790050b8fcf71b6e538d48443f3b656e5a0655e90adb698866f125ae8416fa032b68467299e57c4a9b49e35cec81d9c2e2d875d851f08e6bc80d11aec8be
-
Filesize
342B
MD5abecaa7e191c6d4f6acabd94a3ccd8f6
SHA1f88461b59a3aabe9771e94b6627371223b117107
SHA256f57ffdf38314e5d4773cc57a8d67e9c6d803b044e6d3ad8222114172f788174b
SHA51260c34548eb874005eff57d884a86a4bd188d5273ddb61b83030c6907d0f8fed00ebb6e0c5391be4a3fff0484db3a29029a1701069e0baf7f97220e9ad8a10057
-
Filesize
342B
MD549b564e8dfd59cbc00d58694b409f770
SHA1083473c79a34932030efb3698172c2a421b7146e
SHA256b1e7d1ccffeff3b10f8af88f230e21053c19297004768d3fbf757478a8ab2838
SHA512c3ffd37229e87e8952c61f7799e7ae2420f69ff2b2c6c8eb6b6ed4aebd88d99bf5410f074ce2c5d4ce838d5f6d74a39298a04598f034f0de4169bd458f7680f3
-
Filesize
342B
MD59c8779517159da3972c7c11eaf147fbc
SHA101d5ed630b9ed8099ee5fe2755b52fa33199891c
SHA2564a8e135db48e04b10fa1b33142f085ccc8766a43e7be1efecffe8e1f589ed7f2
SHA512d2454a6d91b8a8d34c45c6f3c091bc9c348134b23c0d1da22f8a3a8d7c65f6e62efdc792e85d303213a69b51753dcdc1560199433e30c2333ffeca03a21e327a
-
Filesize
342B
MD53914aa1d1135f9bc1cff21f7fea9bea9
SHA1f3ae70df21b273930928ed09defc71eb77cbe7e1
SHA25605147e7fff5d40fccb5322046bdab3b02f8f6202a6e3ecc6dc6bcf1c0c753edb
SHA512c898d4ee7a8ca9ef6dd38f11d141a506a2dda9510662000cbce4148b8988cf96e00b11246dcc20498d52b2103e3a6be9b7e08206d196e8500b842bb6fea86f87
-
Filesize
342B
MD51dc10064b131135dd566d2eba983a0ae
SHA1e5c5230538734e50dc02c1ae0badcaef9739e744
SHA25675c5e289790387814789a02a5d92fe68c68a0646437a083a7ab435dcb210eb00
SHA512fee13c05b8111861a5c981d2dd53e1a6036c36540b847c841fda8bd55d2c89a74e20f6a5871a87b15f9ce5fb05e75dffaeda73c9f7b43de6b145b6732aed57cf
-
Filesize
342B
MD5da84394d2fe896b56c33a1da5cebd5bf
SHA1155beeca30be17acbfe55de2931d42241ce4757d
SHA25641e55a9a5f593038eb7c55923f8df5f11a5fa5784a00a43ac097a687cec9dd4e
SHA512f62ab311869578eb902158cedafabeabb0e7e00df980d73e6f02f05fff967de5ff84d307b4fc6a440311b5eca01b1eef6653139dd2e43cb8f0e5df90791a6d5f
-
Filesize
342B
MD52e447b92f7541f3c52343908746064ff
SHA156be9b92234aee31ac582df6afa420c9ae580466
SHA256bbadb90a30cf5435c483ee97bb456ed53ceb3b0b8d1cbdc0a7b97ada4dbc416b
SHA51227d3bd322ea14d92ad5b466ef6e75c590348abad8fded7a3f7affc7f0b68832e2c72286069a4ddd5723bee98ad5554eb130e35246537c6bf0d3bed12b7204c4f
-
Filesize
342B
MD56aeff2b54e6424ed16be22c52de6a56a
SHA12b608b4b3f863ce410eae9ca65f37fd19f9951a6
SHA2566df6bee83059bb0e8f0f39b44ac20ea495f95d07a525abb8379deb5564275912
SHA51271891a6432504d4b1f35916fff54ca1b08598998cabb3c396c5fdd586a9e616635723fd9e0c735317d957bfc87e9f1ba2bf7428be66d4a83f25bec9220c7d3db
-
Filesize
5KB
MD58685a7fb65978e0a20303e6147a868f3
SHA11e8978e279060ce6dfdaf3dbb1354106f4c7bc15
SHA25694f93c812b97e8ce390296dcbc081af3dc77e62d0ac93e06765c4ef10c95fb56
SHA512720461eebe5b1485162d0e6b87e2f56322a2f58f5b75a32b9337dc53df600eebbdaa8ef4b559d8ec7a3210dbe30a46a766107ec17a06d7665dc2dfb3f31e8230
-
Filesize
4KB
MD5b1761aa1b2fd3abbabb02bc4b9d51e5f
SHA112d8b8897697405720c69469a0f86a4cf87e6085
SHA256cc4401333dba2505d368c3515d689cd423c4f71816d81a23dd696143051a7796
SHA5127b2e9e2d2c1ce1c22845e3712383f6338b0959712df4859029331f03a538b63eefe68a7771c6422d2d42407e4ab395f786a67cf6e8daf6c05826f4c81ad8702d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD56b5abad853617018d8e50678e712b18b
SHA19061604a1b9bd2a5f3c32b98517d74300cb30c82
SHA256ed33830f36844022c4c3239e1b28eaad0fa385b23e4178c5ae29d813454aa45e
SHA512da491aab10c9430b327cee1fcedc48e553fa08396681468f4cb54dc0ee17440ffdc660fc7229ba93c88b1230b4a5fc937e25b26b1171b28b09f309bf807cee12
-
Filesize
186KB
MD58ec363843a850f67ebad036bb4d18efd
SHA1ac856eb04ca1665b10bed5a1757f193ff56aca02
SHA25627233293b7a11e9ab8c1bca56a7e415914e1269febb514563e522afd04bc39f8
SHA512800f15fb824a28860719b2ff329dd9bcd94cf9db26c9617656665564b39d8c116552296656f5c109a697b6afc5658f0ba4688e4803358504000f6150047d6684
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
8KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
132KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB